Permission resolution works in 4 layers combined with OR logic, and the most permissive one wins: the user's main role, groups linked to the role, the user's groups and individual permissions. In the Permissions tab, the query shows effective permissions by user, by system or by role, with the source of each access, and refreshes on its own after saving. The system view answers who accesses each module: roles, groups and users, with counters by type.

A dedicated tab appears on every ticket form, pre-selecting the requester and showing their effective permissions, and another one on the user record. For audits, XLSX or CSV reports list effective access (one row per user and module, with its source), the matrix by role and groups with their members, filtered by system, module, role, group and user. The whole configuration moves from one GLPI to another in an XLSX spreadsheet, with a preview of what changes and an automatic backup before applying.