Users /
The same form, empty, creates a new user.
For notifications and a password-reset link. The user can change it under Account.
Leave empty to keep the current one.
Everyone here is an administrator; the role is the reach. Global also sees Server and is the only one who adds or deletes domains. The only global user cannot be changed to domain or deleted.
With All ticked the list below it is ignored — and greyed out where scripts run.
Granted separately from outbound: the same name on both lists is two assignments. The domain role needs at least one domain, or All, on either list.