Access is what a member can reach: courses, hubs, community forums, badges, calendars and events. It is listed on their profile, under the personal sections.
The important thing is not the list itself but where each entry came from.
Two sources on the profile
Every entry in the access list is marked with where it came from, and the list knows two answers.
- Manually assigned. Somebody gave it to this person directly: on the profile, at creation, or in an import.
- A group. They are in a group that carries it, and the entry names the group.
A purchase is not a third answer. Buying a product writes access into the same place a manual grant does, so a course somebody paid for also reads Manually assigned. If the product hands out a group, you see the group. Either way the access list cannot tell you an order is behind it. The Payments section of the profile can.
Why the source matters
You can only remove access where it was given.
Access assigned directly has a remove button on the profile. Access that came through a group does not, because the group is what holds it. Take the person out of the group, or take the resource out of the group, and it goes.
This is the single most common surprise in managing access: you remove a course from someone, and they still have it. Look at the entry again. If it now names a group, the group is what carries it, and the group is where you take it away.
Access from a purchase needs more care. It sits in the same place as a direct grant, so the profile gives you a remove button and the button works. It leaves the order untouched, though, and fulfilment hands the access back later: a subscription re-grants everything its order covers on every renewal, and publishing a course again restores it for everyone who bought it. To end purchased access for good, refund the order in full, or cancel the subscription.
The same access twice
Somebody can hold the same course directly and through a group at once, and the profile shows both sources.
Then removing the direct one changes nothing they can see, because the group still carries it. That is correct behaviour, not a bug, and the source list is what makes it visible.
Granting access by hand
On the profile, open the section you need, use Add, search and assign. It takes effect immediately, with no further step.
Direct assignment is right for exceptions: a refund you want to honour anyway, a guest, a test, one person who should see something before everybody else.
For anything that will happen more than twice, use a group.
Community access
Community splits into forums and badges. Forums are what they can read and post in, badges are what they have earned or been given.
Both work the same way as the rest, including the group route.
Events access
Events split into calendars and individual events. Giving somebody a calendar hands them everything on it, including events you add later, which is usually what you want. Assigning single events is for exceptions.
Checking what someone actually sees
The access list tells you what should be true. To be sure, sign in as them and look.
That is quicker than reasoning about groups and products, and it catches the cases where something is hidden for a different reason entirely, such as a course that is still a draft.
Taking everything away
To close the door completely without deleting anything, deactivate the account from the profile. They keep their data and their history, and they cannot sign in.
A ban does the same with a reason attached, and optionally lets them appeal from the screen they land on.