---
title: "Memberships (permissions)"
description: "The permissions that control who may add and remove members in a group."
url: https://support.sapera.io/en/articles/552-memberships-permissions
collection: "Permissions"
updated: 2026-06-26
language: en
alternates: [da]
---

# Memberships (permissions)

The permissions that control who may add and remove members in a group.

This article covers the permissions that control **who may add and remove members in a group** — that is, who may change which users are part of a role.

You assign these permissions in **Financial** under **Security → Groups** → select a group → **Permissions** (set Allow/Deny per permission). They apply **per organizational unit** — that is, only for memberships in the store/department where they are granted.

## The permissions

### Add

Allows **adding a user as a member of a group** within the organizational unit.

-   If the permission is denied, the attempt to update the membership is rejected — the user cannot be added to the group.
    
-   The permission makes it possible to delegate membership management to e.g. a store manager, without them having to be a full administrator.
    

### Remove

Allows **removing a user from a group** within the organizational unit.

-   If the permission is denied, the user cannot be removed from the group.
    

## Good to know

-   **The permissions apply per organizational unit.** An employee may have the right to administer memberships in one store without having it in another.
    
-   **Add and Remove are separate.** You can grant the right to add without granting the right to remove (or vice versa), if that fits the workflow.
    
-   **Administrators** by default have full membership management on the top organizational unit.
    
-   **Allow vs. Deny:** An explicit **Deny** wins over an inherited **Allow**.