You can review and grant/deny GN4 system permissions for a group or user on the Permissions tab of the selected group or user in the EdAdmin4 (Security > Users and Groups).
Every system permission can be granted (green icon with +), denied (red icon with -) or undefined (gray icon).
By default, system permissions are all undefined, which means that the members of that group may inherit them from some another group they're members of.
See System permissions, for detailed explanation.
Grant/deny system permissions
To grant a system permission, click the permission until the icon becomes green containing + (a plus sign).
To deny a system permission, click the permission the icon becomes red containing - (a minus sign).
To undefine a system permission, click the permissions until the icon becomes gray.
On the following screenshot, the Default permission is granted, the Manage volumes permission is denied, while other permissions are undefined.
See also