---
key: check-what-a-user-can-access
title: Check why someone can or cannot do something
audience: staff
section: administration/team-access
routes: ["/settings/org/rbac/debugger"]
permissions: ["rbac.permissions.read"]
features: ["settings.org.rbac"]
since: 0.0.1
updated: 0.0.1
status: published
summary: Pick a team member and a permission to see whether Nova grants it, which roles or overrides decide that, and what to change.
keywords: [access denied, why can't they see, permission check, troubleshoot access, effective permission, who can do what, debugger]
related: [create-a-role, give-a-user-a-permission-override, change-a-team-members-roles]
---

In the sidebar, open **Administration**, then choose **Access Checker** under **Team & Access**. The page address is `/settings/org/rbac/debugger`.

Use this when a team member says a button is missing or a page refuses them. It answers one question at a time: can this person do this?

## Before you start

- Your admin has to give your role permission to write roles (or to manage roles and permissions) to run a check. With only permission to read permissions you can open the page, but the fields stay greyed out.

## Steps

1. Under **Select user**, type the person's name or email and pick them.
2. Under **Permission**, use **Search permissions** to find the permission by name, description or module, and pick it.
3. Press **Check access**.

## What you see

- The result reads **Access granted** or **Access denied**, with a reason code under it and counts of the roles, overrides and implied permissions involved. A matching **Allowed** or **Denied** tag appears beside **Check access**.
- **Roles granting** lists the roles that include the permission. Empty means no role grants it; add it to one of the person's roles in [[create-a-role]] or give them a role that has it in [[change-a-team-members-roles]].
- **Overrides** shows any allow or deny set for this person. A deny always wins; clear it in [[give-a-user-a-permission-override]].
- **Implied by** lists broader permissions that carry this one with them.
- **Clear selection** under the permission lets you check another one for the same person.
- **Copy explanation** copies the whole answer so you can paste it into a message to your admin or to Nova support.

## If something looks different

- The page tells you to select a user and permission: both are needed before **Check access** works.
- A person has the permission but still cannot use the feature: the feature may not be in your plan, or the record may belong to a branch they cannot access.
- There is a box for optional extra context: leave it blank for ordinary checks. It is for support staff.

[[route:/settings/org/rbac/debugger|Open Access Checker]]