Make removing members from subresources optional

Problem to solve

As an Owner user I'd like to be able to remove my users only from higher level groups and retain their membership in subgroups so I can more effectively and quickly groom my user permissions. Right now this isn't possible as removing higher level permissions also removes lower lever permisisons.

Intended users

Further details

Vignette: Today a group of owner users including myself were moving to a more appropriate permission scheme and adding users to subgroups instead of our topmost level group. The workflow for this included, per user, add to subgroup A, add to subgroup B, remove from master group. Well, we didn't realize (or read) the warning when removing users from the master group and so with that workflow effectively removed all our users from the entire tree (NOT our intent). If we could have chosen (perhaps via checkbox) whether we wanted to remove them just from the top level group or all groups (including those below the one we were removing them from) our workflow may have worked.

While trying to get 45 users (our impact) back into the appropriate groups isn't herculean, it is unfortunate and an inconvenience. I thought this feature request would be useful to others in the future who are looking to prune high access users into sub groups/projects so they don't inadvertently remove all their accesses.

Proposal

Recommend adding an option for owners (perhaps a checkbox) to remove users from ONLY the group in question or from this and all subresources (current only option behavior).

I believe you should retain both options because the current behavior (remove from current and all subresources) is an effective means to remove a users access throughout which is likely a common desire.

Adding the option (opt in) to remove users from ONLY the group in question would be useful if someone perhaps had reasons for elevated rights before, but no longer does.

Alternatives could potentially include "moving" a users access from a higher level (group) to a lower level (subgroup/project).

Permissions and Security

Documentation

Availability & Testing

What does success look like, and how can we measure that?

What is the type of buyer?

Is this a cross-stage feature?

Links / references

Edited by Garrett Heaton