You cannot edit a `employee`. Only higher-level users have this power.

Hi Kyle,
I have a moderator group called HR and they are supposed to edit some fields in a tab that only HR can edit (settings are set to HR being moderators).

When the HR user looks at the corresponding tab, the field is there but the HR cannot edit the field (I wanted to use AJAX here). Also when that user clicks on EDIT field (above the canvas) then he/she gets a system message with "You cannot edit a `employee`. Only higher-level users have this power.".

The problem is that HR is already under SUPER USER, so why can HR not edit the user?

If they have Super Users AND Registered usergroups you'll get access conflicts like that. Removing Registered from their list of usergroups will resolve this.

Worked.

BUT, how do you prevent the double user roles? I am planning on having a user selecting what roles to assign and I am sure that people will do the mistake of assigning several roles to HR...

Best I can suggest is to just inform them how to do it properly or try to force the usergroups to be clean using CB Auto Actions by acting on after update user trigger.