feat(docs): document role Assignees view in GAC (#3031)

## Description 

Document the role **Assignees** view in GAC: Assignees column counts,
**Permissions** | **Assignees** tabs, _Direct_ / _via group_ sources,
filters, search, and **Default Role for All Users** behavior.
Update related GAC, user management, and troubleshooting pages to point
at the **Assignees** view and the **Permissions** tab layout.
No URL changes; no new redirects required.

## Pull request type

- [ ] Review Fixes
- [ ] Documentation Overhaul
- [x] Feature/Story
- appsmithorg/appsmith-ee#9407 (implements
appsmithorg/appsmith-ee#8726)
- [ ] A-Force
- [ ] Error in documentation
- [ ] Maintenance

## Documentation tickets

## Checklist

From the below options, select the ones that are applicable:

- [ ] Checked for Grammarly suggestions.
- [x] Adhered to the writing checklist.
- [x] Adhered to the media checklist.
- [x] Verified and updated cross-references or added redirect rules.
- [x] Tested the redirect rules on deploy preview.
- [x] Validated the modifications made to the content on the deploy
preview.
- [ ] Validated the CSS modifications on different screen sizes.

---------

Co-authored-by: Luis Ibarra <98054342+sebastianiv21@users.noreply.github.com>

Author: amelia-c0n

.github/styles/config/vocabularies/technical/accept.txt

@@ -153,4 +153,6 @@ AWS ECS EC2
 Droplet
 Enable webhook trigger
 Validation
-Issuer
+Issuer
+Assignees
+SCIM

website/docs/advanced-concepts/granular-access-control/README.md

@@ -31,7 +31,7 @@ Granular Access Control (GAC) in Appsmith allows you to specify precise access p
 ## Core components
 
 * **Permissions** - define the actions users can perform on specific resources. In Appsmith, each resource, whether an app, page, workflow, datasource, environment, or query, can have detailed permissions for actions such as create, read, update, and delete.
-* **Roles** - are sets of permissions bundled together that can be assigned to users or user groups. They provide varying levels of access to Appsmith resources.
+* **Roles** - are sets of permissions bundled together that can be assigned to users or user groups. They provide varying levels of access to Appsmith resources. On the Roles screen, you can review who has each role from the [Assignees](/advanced-concepts/granular-access-control/roles#view-role-assignees) view.
 * **Users** - Individual users who need access to the Appsmith instance.
 * **User Groups** - Collections of users that allow you to assign roles to multiple users simultaneously. Users in a group inherit the roles assigned to that group.
 

website/docs/advanced-concepts/granular-access-control/how-to-guides/configure-default-permissions.mdx

@@ -44,8 +44,8 @@ Follow these steps to configure permissions:
    <ZoomImage src="/img/GAC-Default-Roles-toggle.png" alt="Toggle the Default roles options to view Default Roles" caption="Toggle the Default roles options to view Default Roles"
    />
 
-4. Click the _Default Role For All Users_ that opens a configuration screen.
-5. Based on your permission needs, provide access to resources. For example, if you want to provide read-only access to an application so that all authenticated users can view it, assign permissions as below:
+4. Click **Default Role For All Users** to open the role page.
+5. On the **Permissions** tab, provide access to resources based on your needs. The **Assignees** tab shows **Assigned to all users** because every user in the instance inherits this role. For example, if you want to provide read-only access to an application so that all authenticated users can view it, assign permissions as below:
 
 <Tabs queryString="gac-resource">
    <TabItem label="Application Resources" value="application-resources">

website/docs/advanced-concepts/granular-access-control/reference/custom-roles.mdx

@@ -28,7 +28,7 @@ Appsmith allows the creation of custom roles to manage granular access control,
 
 ## Create custom role
 
-To create a custom role, click the **Add role** button on the Roles screen. On the roles configuration screen, assign permissions to resources in each tab based on your business needs.
+To create a custom role, click the **Add role** button on the Roles screen. On the role page, open the **Permissions** tab and assign permissions to resources in each resource tab based on your business needs. Use the **Assignees** tab to review which users currently have the role. For more information, see [View role assignees](/advanced-concepts/granular-access-control/roles#view-role-assignees).
 
  <ZoomImage
     src="/img/GAC-Create-Custom-Roles-Add-Role-button.png" 
@@ -106,7 +106,7 @@ To restrict access to specific pages within an Appsmith application, modify the
 
 ### Give app access
 
-To give access to specific applications within an Appsmith workspace, configure the permissions at the application level for the custom role. When creating a new custom role, it's necessary to also configure permissions for the datasources and environments used by the application. After configuring these permissions, assign the custom role to the necessary users or groups to grant them the required access.
+To give access to specific applications within an Appsmith workspace, configure the permissions at the application level for the custom role under the **Permissions** tab. When creating a new custom role, it's necessary to also configure permissions for the datasources and environments used by the application. After configuring these permissions, assign the custom role to the necessary users or groups to grant them the required access. You can confirm the assignment on the role's **Assignees** tab.
 
 Example permissions setup to provide read-only access:
 
@@ -287,3 +287,4 @@ Example permissions setup to provide read-only access:
 
 * [Restrict Query Access](/advanced-concepts/granular-access-control/how-to-guides/restrict-query-access)
 * [Permissions](/advanced-concepts/granular-access-control/reference/permissions)
+* [View role assignees](/advanced-concepts/granular-access-control/roles#view-role-assignees)

website/docs/advanced-concepts/granular-access-control/reference/default-roles.md

@@ -121,7 +121,9 @@ Despite having extensive permissions, the Organization Administrator role in App
 
 ## Default Role for All Users
 
-Default Roles for All users helps you in assigning some default permissions to all users across your Appsmith instance.  Initially, the role has [permission to create workspace](/advanced-concepts/granular-access-control/reference/permissions?gac-resource=create-others). For all other permissions, Instance administrators can fully customize this role according to your business needs. For more information, see [How to provide default access to all users](/advanced-concepts/granular-access-control/how-to-guides/configure-default-permissions) guide.
+Default Role for All Users helps you assign some default permissions to all users across your Appsmith instance. Initially, the role has [permission to create workspace](/advanced-concepts/granular-access-control/reference/permissions?gac-resource=create-others). For all other permissions, instance administrators can fully customize this role according to your business needs. For more information, see [How to provide default access to all users](/advanced-concepts/granular-access-control/how-to-guides/configure-default-permissions).
+
+On the Roles screen, the **Assignees** column shows **All users** for this role. On the role page, the **Assignees** tab shows **Assigned to all users** instead of listing individual users, because membership is implicit for every user in the instance. Configure permissions on the **Permissions** tab. For more information about viewing assignees on other roles, see [View role assignees](/advanced-concepts/granular-access-control/roles#view-role-assignees).
 
 ## Administrator Role for Workspace
 

website/docs/advanced-concepts/granular-access-control/roles.md

@@ -70,3 +70,65 @@ Custom roles in Appsmith allow users to define specific permission sets tailored
     alt="Click the Add role button to create a custom role"
     caption="Click the Add role button to create a custom role"
   />
+
+## View role assignees
+
+The Roles screen shows how each role is assigned. The **Assignees** column lists direct assignment counts as `N users · M groups`. For the [Default Role for All Users](/advanced-concepts/granular-access-control/reference/default-roles#default-role-for-all-users), the column shows **All users** instead of numeric counts, because every user in the instance inherits that role.
+
+ <ZoomImage
+    src="/img/GAC-Roles-Assignees-column.png"
+    alt="Assignees column on the Roles screen showing user and group counts"
+    caption="Assignees column on the Roles screen"
+  />
+
+To review who has a role:
+
+1. Go to **Admin Settings** > **Roles**.
+2. Open the role.
+3. Select the **Assignees** tab. Use the **Permissions** tab to configure the role's permission tree.
+
+ <ZoomImage
+    src="/img/GAC-Role-Assignees-tab.png"
+    alt="Assignees tab on a role showing users with Direct and via group sources"
+    caption="Assignees tab on a role"
+  />
+
+The **Assignees** tab is view-only. It lists users who have the role either directly or through a group. To assign or unassign a role, use the [Users](/getting-started/setup/instance-configuration/user-management#users) or [Groups](/getting-started/setup/instance-configuration/user-management#groups) pages.
+
+### Assignee sources
+
+Each user row shows the assignment source:
+
+* **Direct**: You assigned the role to the user.
+* **via group name**: You assigned the role to a group that includes the user. The group name links to that group's settings page.
+
+A user can show both sources when you assign the role directly and through one or more groups. Users provisioned through System for Cross-domain Identity Management (SCIM) show a provisioned indicator next to their username. For more information, see [User Provisioning & Group Sync](/advanced-concepts/user-provisioning-group-sync).
+
+### Filter and search assignees
+
+Use the filter control on the **Assignees** tab to narrow the list:
+
+| Filter | Shows |
+| --- | --- |
+| **All** | Users with the role from any source |
+| **Direct** | Users assigned the role directly |
+| **Via group** | Users who inherit the role through a group |
+
+Use the search field on the role page to find assignees by username. Scroll the list to load more results when a role has many assignees.
+
+### Default Role for All Users
+
+For the **Default Role for All Users**, the **Assignees** tab shows **Assigned to all users** instead of an enumerated list. Membership is implicit for every user in the instance. Configure the permissions for this role on the **Permissions** tab. For more information, see [Configure Default Access to Apps](/advanced-concepts/granular-access-control/how-to-guides/configure-default-permissions).
+
+ <ZoomImage
+    src="/img/GAC-Default-Role-Assignees-all-users.png"
+    alt="Assignees tab for Default Role For All Users showing Assigned to all users"
+    caption="Assignees tab for Default Role For All Users"
+  />
+
+## See also
+
+* [Custom Roles](/advanced-concepts/granular-access-control/reference/custom-roles)
+* [Default Roles](/advanced-concepts/granular-access-control/reference/default-roles)
+* [Permissions](/advanced-concepts/granular-access-control/reference/permissions)
+* [User Management](/getting-started/setup/instance-configuration/user-management)

website/docs/getting-started/setup/instance-configuration/user-management.md

@@ -136,7 +136,7 @@ Users are individuals who have access to your Appsmith instance. From the Users
 Administrators can:
 
 - Invite new users.
-- Assign or update user roles (e.g., Viewer, Developer, Admin).
+- Assign or update user roles (for example, Viewer, Developer, Admin).
 - Add users to specific groups.
 - Deactivate or remove users from the instance.
 
@@ -152,7 +152,7 @@ Groups allow administrators to organize users into logical collections for easie
 <dd>
 With the Groups feature, administrators can:
 
-- Create and name groups based on roles (e.g., “Developers”, “Support Team”, “Finance”)
+- Create and name groups based on roles (for example, “Developers”, “Support Team”, “Finance”)
 - Add or remove users from specific groups
 - Assign roles (such as Viewer, Editor, Administrator) to the entire group
 
@@ -168,7 +168,7 @@ Roles define what actions a user or group is allowed to perform within your Apps
 
 <dd>
 
-Roles can be assigned to individual users or to groups, making it easier to manage access consistently and securely across your organization.
+Roles can be assigned to individual users or to groups, making it easier to manage access consistently and securely across your organization. To see who already has a role, open the role on the Roles page and select the **Assignees** tab. For more information, see [View role assignees](/advanced-concepts/granular-access-control/roles#view-role-assignees).
 
 Appsmith supports two types of roles:
 

website/docs/help-and-support/troubleshooting-guide/gac-errors.mdx

@@ -59,8 +59,8 @@ A custom role that provides access to the application is created, but users are
 
 #### Solution
 
-* Verify if the custom role access is provided by checking the groups and role mapping or user and role assignment. If not, add users to groups that have access or assign roles to the appropriate users.
-* Ensure you have granted the necessary access to the datasources used by the application under the _Datasources & Environments_ tab when configuring the custom role. For more details on permissions, see [Permissions](/advanced-concepts/granular-access-control/reference/permissions).
+* Verify if the custom role access is provided by checking the groups and role mapping or user and role assignment. You can also open the role under **Admin Settings > Roles**, select the **Assignees** tab, and confirm whether the user appears as a **Direct** assignee or **via** a group. If not, add users to groups that have access or assign roles to the appropriate users.
+* Ensure you have granted the necessary access to the datasources used by the application under the _Datasources & Environments_ tab when configuring the custom role. For more details on permissions, see [Permissions](/advanced-concepts/granular-access-control/reference/permissions). For more details on reviewing assignees, see [View role assignees](/advanced-concepts/granular-access-control/roles#view-role-assignees).
 
 ## Getting help
 

website/docs/help-and-support/troubleshooting-guide/user-management-errors.md

@@ -27,6 +27,7 @@ The user still has a default role (such as **App Viewer**) assigned in addition
 #### Solution
 
 - Go to **Admin Settings > Users** and review every role assigned to the user, not just the custom role.
+- Open the custom role under **Admin Settings > Roles**, select the **Assignees** tab, and confirm how the user receives the role (**Direct** or **via** a group). For more information, see [View role assignees](/advanced-concepts/granular-access-control/roles#view-role-assignees).
 - Remove the broad default role (for example, App Viewer) from the user, and rely on the custom role with **View** permission for only the intended pages.
 - Ensure the **View** permission is also enabled at the application level, not only at the page level.
 - For more details on building roles, see [Custom Roles](/advanced-concepts/granular-access-control/reference/custom-roles) and [Permissions](/advanced-concepts/granular-access-control/reference/permissions).
@@ -40,7 +41,7 @@ After accepting an invite and logging in, the user lands on an empty home screen
 #### Solution
 
 - Ask an instance administrator to review the user's current configuration under **Admin Settings > Users**.
-- Confirm the role granting access is actually assigned and that **View** is enabled at the application level.
+- Confirm the role granting access is actually assigned and that **View** is enabled at the application level. You can also open that role under **Admin Settings > Roles** and check the **Assignees** tab.
 - If the issue persists, collect the backend server logs covering the time range when the access was configured (`docker logs <container>` for Docker, or `kubectl logs <pod>` for Kubernetes) and share them with support for further investigation.
 
 ### Permission denied on query execute despite a working role