Manage the principals ACLs apply to — sys_user, sys_user_group, sys_user_grmember and sys_user_has_role. Group before membership, inherited versus direct roles, why removing a role does not always remove the access, and deactivate rather than delete.
