Create user
Requires the `users:write` management permission. The service validates role assignment and tenant scope against the caller.
List users
Requires `users:read`; results are restricted to the caller's accessible tenant scope.
Get user
Requires `users:read` and access to the target user.
Update user
Requires `users:write`; role and access-grant changes are constrained by the caller's authority.
Delete user
Requires `users:write` and sufficient authority over the target user.
Activate user
Requires `users:write` and sufficient authority over the target user.
Deactivate user
Requires `users:write` and sufficient authority over the target user.
Send password reset
Requires `users:write` and sufficient authority over the target user.
Restore user
Requires `users:write` and sufficient authority over the target user.