Overriding one customer

A customer screen has App permissions, where the defaults can be overridden just for that customer. Every permission shows three choices: Default follows the global setting, On forces it available for this customer whatever the default, and Off takes it away from this customer only. A permission left on Default changes automatically if you later change the global default; one set to On or Off stays put regardless. At the top is Block from the app, a single switch that turns the whole app off for that customer: they cannot sign in or do anything until it is turned back on, which is the quickest response to a problem account. Changes take effect the next time the customer app refreshes, which happens on their next sign-in or action.