Regular non-user-administrator is able to administer users.

[darrenpeters]

If I create a user with the "administrator" permission but NOT the "user_administrator" permission, they are still able to administer users.

[maximebeaudoin]

By default, the administrator role is more like a super user. The user administrator role have only CRUD privileges to user. In fact, the default config is more a example config file.

You can refer to this https://github.com/firalabs/firadmin/blob/master/src/config/config.php#L113

[darrenpeters]

Okay. I had always assumed that a non-user administrator could administrate everything BUT users.

A user administrator as you have it is quite pointless, since the user administrator can then just create themselves a full-out administrator, no? Self-promotion as it were.

[maximebeaudoin]

Exactly, i should probably remove this default roles and simply add some commented example in the config file.

[darrenpeters]

Okay, thanks. Would be nice if the example could apply somehow to extra controllers we create that extend your BaseController.