See the impact before changing a role's keys
On the Roles screen you edit a role's keys, see who will be affected with “What will change?”, and only then apply.
Prerequisite
The preview needs only read permission (role.read); applying needs role.write on the platform. A role's keys are the same in every scope, so changing them is a platform decision.
Steps
- Switch to the platform with the scope switcher and open Roles under People and access.
- Choose the role in the list on the left, then tick the keys you want to add or remove in the Permissions list on the right.
- Press What will change?. The affected people are listed.
- If you like, pick a person and a key in the impact panel to see how the decision turns out for that person: “This decision flips: allow → deny” or “This decision does not change.”
- When you are sure, press Apply. Apply is enabled only after the preview.
Result
The screen shows “Applied:” with the number of permissions written. The change affects everyone who holds this role, in every scope the role is assigned in.
Keep in mind Scope lives in the assignment, not in the key. You cannot make a role behave differently in just one tenant from here; for that, a different role is assigned in that tenant.