From 3ec7f33c4c45ba0526324e865a1af789e6683925 Mon Sep 17 00:00:00 2001
From: "Maksym Hryzodub [DREAM]" <maksym.hryzodub@dreamvention.com>
Date: Fri, 24 Jul 2026 12:12:54 +0200
Subject: [PATCH 1/2] feat(user): Implement user management components

- Added new Vue components for user creation, editing, and listing, enhancing the user management interface.
- Introduced `UserForm` for handling user data input, including validation and role management.
- Implemented user detail view with options to edit and remove users, improving user interaction and management capabilities.
- Enhanced user data mapping to include initials for better UI representation.

This update significantly improves the user management experience, providing a comprehensive interface for managing user accounts effectively.
---
 .../{userCreate => user/create}/Provider.vue  |  2 +-
 .../{userEdit => user/edit}/Provider.vue      |  2 +-
 .../user/components/user/{ => item}/Form.vue  | 13 +--------
 .../components/user/{ => item}/Provider.vue   | 25 ++---------------
 .../{userList => user/list}/Provider.vue      | 28 ++-----------------
 admin/slices/user/user/data/user.mapper.ts    | 14 +++++++++-
 admin/slices/user/user/domain/user.types.ts   |  4 +++
 .../user/user/pages/users/[id]/index.vue      |  2 +-
 admin/slices/user/user/pages/users/index.vue  |  4 +--
 admin/slices/user/user/stores/user.ts         |  6 ----
 10 files changed, 28 insertions(+), 72 deletions(-)
 rename admin/slices/user/user/components/{userCreate => user/create}/Provider.vue (93%)
 rename admin/slices/user/user/components/{userEdit => user/edit}/Provider.vue (98%)
 rename admin/slices/user/user/components/user/{ => item}/Form.vue (93%)
 rename admin/slices/user/user/components/user/{ => item}/Provider.vue (84%)
 rename admin/slices/user/user/components/{userList => user/list}/Provider.vue (85%)

diff --git a/admin/slices/user/user/components/userCreate/Provider.vue b/admin/slices/user/user/components/user/create/Provider.vue
similarity index 93%
rename from admin/slices/user/user/components/userCreate/Provider.vue
rename to admin/slices/user/user/components/user/create/Provider.vue
index 226afee0..6ffcbc59 100644
--- a/admin/slices/user/user/components/userCreate/Provider.vue
+++ b/admin/slices/user/user/components/user/create/Provider.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import type { ICreateUserData } from '#user/stores/user';
+import type { ICreateUserData } from '#user/domain/user.types';
 import { IconArrowLeft } from '@tabler/icons-vue';
 
 const userStore = useUserStore();
diff --git a/admin/slices/user/user/components/userEdit/Provider.vue b/admin/slices/user/user/components/user/edit/Provider.vue
similarity index 98%
rename from admin/slices/user/user/components/userEdit/Provider.vue
rename to admin/slices/user/user/components/user/edit/Provider.vue
index 137d16d1..db0d0e62 100644
--- a/admin/slices/user/user/components/userEdit/Provider.vue
+++ b/admin/slices/user/user/components/user/edit/Provider.vue
@@ -3,7 +3,7 @@ import {
   UserRoleTypes,
   type ICreateUserData,
   type IUpdateUserData,
-} from '#user/stores/user';
+} from '#user/domain/user.types';
 import { IconArrowLeft } from '@tabler/icons-vue';
 
 const props = defineProps<{ id: string }>();
diff --git a/admin/slices/user/user/components/user/Form.vue b/admin/slices/user/user/components/user/item/Form.vue
similarity index 93%
rename from admin/slices/user/user/components/user/Form.vue
rename to admin/slices/user/user/components/user/item/Form.vue
index 2a8df2cd..2cae1225 100644
--- a/admin/slices/user/user/components/user/Form.vue
+++ b/admin/slices/user/user/components/user/item/Form.vue
@@ -3,18 +3,7 @@ import {
   ALL_USER_ROLES,
   UserRoleTypes,
   type ICreateUserData,
-} from '#user/stores/user';
-import { Button } from '#theme/components/ui/button';
-import { Checkbox } from '#theme/components/ui/checkbox';
-import { Input } from '#theme/components/ui/input';
-import { Label } from '#theme/components/ui/label';
-import {
-  Card,
-  CardContent,
-  CardDescription,
-  CardHeader,
-  CardTitle,
-} from '#theme/components/ui/card';
+} from '#user/domain/user.types';
 
 const props = withDefaults(
   defineProps<{
diff --git a/admin/slices/user/user/components/user/Provider.vue b/admin/slices/user/user/components/user/item/Provider.vue
similarity index 84%
rename from admin/slices/user/user/components/user/Provider.vue
rename to admin/slices/user/user/components/user/item/Provider.vue
index 6eb51be1..545e891e 100644
--- a/admin/slices/user/user/components/user/Provider.vue
+++ b/admin/slices/user/user/components/user/item/Provider.vue
@@ -1,16 +1,5 @@
 <script setup lang="ts">
-import { UserStatusTypes } from '#user/stores/user';
-import { Button } from '#theme/components/ui/button';
-import { Badge } from '#theme/components/ui/badge';
-import { Avatar, AvatarFallback } from '#theme/components/ui/avatar';
-import {
-  Card,
-  CardContent,
-  CardDescription,
-  CardHeader,
-  CardTitle,
-} from '#theme/components/ui/card';
-import { IconArrowLeft } from '@tabler/icons-vue';
+import { UserStatusTypes, UserRoleTypes } from '#user/domain/user.types';
 
 const props = defineProps<{ id: string }>();
 const userStore = useUserStore();
@@ -26,14 +15,6 @@ const statusVariant: Record<UserStatusTypes, 'default' | 'secondary' | 'outline'
   [UserStatusTypes.Disabled]: 'outline',
 };
 
-const initials = (name: string) =>
-  name
-    .split(' ')
-    .map((p) => p[0])
-    .slice(0, 2)
-    .join('')
-    .toUpperCase();
-
 const formatDate = (iso: string) =>
   new Date(iso).toLocaleDateString(undefined, { dateStyle: 'medium' });
 
@@ -58,7 +39,7 @@ async function onRemove() {
       <div class="flex items-start justify-between gap-4">
         <div class="flex items-center gap-4">
           <Avatar class="size-14">
-            <AvatarFallback class="text-base">{{ initials(user.name) }}</AvatarFallback>
+            <AvatarFallback class="text-base">{{ user.initials }}</AvatarFallback>
           </Avatar>
           <div>
             <h1 class="text-2xl font-semibold">{{ user.name }}</h1>
@@ -70,7 +51,7 @@ async function onRemove() {
           <Button
             variant="ghost"
             class="text-destructive"
-            :disabled="user.roles.includes('Owner')"
+            :disabled="user.roles.includes(UserRoleTypes.Owner)"
             @click="confirmRemoveOpen = true"
           >
             Remove
diff --git a/admin/slices/user/user/components/userList/Provider.vue b/admin/slices/user/user/components/user/list/Provider.vue
similarity index 85%
rename from admin/slices/user/user/components/userList/Provider.vue
rename to admin/slices/user/user/components/user/list/Provider.vue
index e1ac670b..918dae9b 100644
--- a/admin/slices/user/user/components/userList/Provider.vue
+++ b/admin/slices/user/user/components/user/list/Provider.vue
@@ -1,19 +1,5 @@
 <script setup lang="ts">
-import { UserStatusTypes, type IUserData } from '#user/stores/user';
-import { Button } from '#theme/components/ui/button';
-import { Badge } from '#theme/components/ui/badge';
-import {
-  Avatar,
-  AvatarFallback,
-} from '#theme/components/ui/avatar';
-import {
-  Table,
-  TableBody,
-  TableCell,
-  TableHead,
-  TableHeader,
-  TableRow,
-} from '#theme/components/ui/table';
+import { UserStatusTypes, UserRoleTypes, type IUserData } from '#user/domain/user.types';
 
 const userStore = useUserStore();
 
@@ -28,14 +14,6 @@ const statusVariant: Record<UserStatusTypes, 'default' | 'secondary' | 'outline'
   [UserStatusTypes.Disabled]: 'outline',
 };
 
-const initials = (name: string) =>
-  name
-    .split(' ')
-    .map((p) => p[0])
-    .slice(0, 2)
-    .join('')
-    .toUpperCase();
-
 const pendingRemoval = ref<IUserData | null>(null);
 const confirmRemoveOpen = computed({
   get: () => pendingRemoval.value !== null,
@@ -88,7 +66,7 @@ async function onRemove() {
             <TableCell>
               <div class="flex items-center gap-3">
                 <Avatar class="size-8">
-                  <AvatarFallback>{{ initials(user.name) }}</AvatarFallback>
+                  <AvatarFallback>{{ user.initials }}</AvatarFallback>
                 </Avatar>
                 <div>
                   <div class="font-medium">{{ user.name }}</div>
@@ -122,7 +100,7 @@ async function onRemove() {
                   size="sm"
                   variant="ghost"
                   class="text-destructive"
-                  :disabled="user.roles.includes('Owner')"
+                  :disabled="user.roles.includes(UserRoleTypes.Owner)"
                   @click="pendingRemoval = user"
                 >
                   Remove
diff --git a/admin/slices/user/user/data/user.mapper.ts b/admin/slices/user/user/data/user.mapper.ts
index 6bb65a13..6dfcfa85 100644
--- a/admin/slices/user/user/data/user.mapper.ts
+++ b/admin/slices/user/user/data/user.mapper.ts
@@ -27,10 +27,12 @@ export class UserMapper {
     if (!raw || typeof raw !== 'object') return null;
     const o = raw as Record<string, unknown>;
     if (typeof o.id !== 'string') return null;
+    const name = str(o.name);
     return {
       id: o.id,
-      name: str(o.name),
+      name,
       email: str(o.email),
+      initials: this.toInitials(name),
       roles: this.toRoles(o.roles),
       status: this.toStatus(o.status),
       createdAt: str(o.createdAt),
@@ -78,4 +80,14 @@ export class UserMapper {
       ? (raw as UserStatusTypes)
       : UserStatusTypes.Active;
   }
+
+  private toInitials(name: string): string {
+    return name
+      .split(' ')
+      .filter(Boolean)
+      .map((p) => p[0])
+      .slice(0, 2)
+      .join('')
+      .toUpperCase();
+  }
 }
diff --git a/admin/slices/user/user/domain/user.types.ts b/admin/slices/user/user/domain/user.types.ts
index 7518ddee..af86398b 100644
--- a/admin/slices/user/user/domain/user.types.ts
+++ b/admin/slices/user/user/domain/user.types.ts
@@ -22,6 +22,10 @@ export interface IUserData {
   id: string;
   name: string;
   email: string;
+  // Derived from `name` in UserMapper.toEntity — carried on the entity so
+  // avatar UIs (userList, user detail) don't each reimplement the same
+  // split/slice/uppercase logic.
+  initials: string;
   roles: UserRoleTypes[];
   status: UserStatusTypes;
   createdAt: string;
diff --git a/admin/slices/user/user/pages/users/[id]/index.vue b/admin/slices/user/user/pages/users/[id]/index.vue
index 5ad9b9eb..e4e9c500 100644
--- a/admin/slices/user/user/pages/users/[id]/index.vue
+++ b/admin/slices/user/user/pages/users/[id]/index.vue
@@ -4,5 +4,5 @@ const id = route.params.id as string;
 </script>
 
 <template>
-  <UserProvider :id="id" />
+  <UserItemProvider :id="id" />
 </template>
diff --git a/admin/slices/user/user/pages/users/index.vue b/admin/slices/user/user/pages/users/index.vue
index 5d89c30f..e7e9eae3 100644
--- a/admin/slices/user/user/pages/users/index.vue
+++ b/admin/slices/user/user/pages/users/index.vue
@@ -1,5 +1,3 @@
 <template>
-  <div>
-    <UserListProvider />
-  </div>
+  <UserListProvider />
 </template>
diff --git a/admin/slices/user/user/stores/user.ts b/admin/slices/user/user/stores/user.ts
index 730a020b..bbde843a 100644
--- a/admin/slices/user/user/stores/user.ts
+++ b/admin/slices/user/user/stores/user.ts
@@ -7,12 +7,6 @@ import type {
   UserService,
 } from '#user/domain';
 
-// Re-export the domain enums/types so consumers importing them from
-// `#user/stores/user` (user Form/Provider, userList/Create/Edit) keep working.
-// The enums are used as runtime values, so they're value re-exports.
-export { ALL_USER_ROLES, UserRoleTypes, UserStatusTypes } from '#user/domain';
-export type { ICreateUserData, IUpdateUserData, IUserData } from '#user/domain';
-
 const getService = createServiceGetter<UserService>('$userService');
 
 export const useUserStore = defineStore('user', () => {

From 6ed3449baef36b116591bb945123fcc254517e81 Mon Sep 17 00:00:00 2001
From: "Maksym Hryzodub [DREAM]" <maksym.hryzodub@dreamvention.com>
Date: Fri, 24 Jul 2026 14:32:28 +0200
Subject: [PATCH 2/2] feat(user): Refactor user role management and enhance
 date components

- Updated user role handling to a single role system, simplifying user management.
- Introduced new components for displaying time ago and formatted date, improving UI consistency.
- Added new utility functions for date formatting and integrated them into user components.
- Updated API schemas and data mappers to reflect changes in user role structure.

This update streamlines user role management and enhances the user interface for date handling, providing a more cohesive experience.
---
 .vscode/settings.json                         |  3 +
 admin/package.json                            |  2 +-
 .../slices/common/components/date/TimeAgo.vue | 25 +++++
 .../slices/common/components/date/TimeAt.vue  | 12 +++
 admin/slices/common/utils/formatDate.ts       |  4 +
 admin/slices/common/utils/index.ts            |  1 +
 .../api/data/repositories/api/schemas.gen.ts  | 35 ++++---
 .../api/data/repositories/api/sdk.gen.ts      | 14 +--
 .../api/data/repositories/api/types.gen.ts    | 19 ++--
 .../components/ui/radio-group/RadioGroup.vue  | 24 +++++
 .../ui/radio-group/RadioGroupItem.vue         | 31 +++++++
 .../theme/components/ui/radio-group/index.ts  |  2 +
 admin/slices/user/auth/data/auth.mapper.ts    |  6 +-
 admin/slices/user/auth/domain/auth.types.ts   |  2 +-
 admin/slices/user/auth/stores/auth.ts         |  4 +-
 .../user/components/user/create/Provider.vue  |  5 +-
 .../user/components/user/edit/Provider.vue    | 23 ++---
 .../user/user/components/user/item/Form.vue   | 93 ++++++++-----------
 .../user/components/user/item/Provider.vue    | 15 +--
 .../user/components/user/list/Provider.vue    | 27 +++---
 admin/slices/user/user/data/user.gateway.ts   |  8 +-
 admin/slices/user/user/data/user.mapper.ts    | 19 ++--
 admin/slices/user/user/domain/user.gateway.ts |  2 +-
 admin/slices/user/user/domain/user.service.ts |  4 +-
 admin/slices/user/user/domain/user.types.ts   | 11 ++-
 admin/slices/user/user/pages.ts               |  6 ++
 admin/slices/user/user/stores/user.ts         |  6 +-
 .../migration.sql                             | 12 +++
 .../slices/setup/init/domain/init.service.ts  |  6 +-
 .../slices/user/auth/domain/auth.service.ts   | 16 +++-
 api/src/slices/user/auth/domain/auth.types.ts |  2 +
 .../slices/user/auth/guards/roles.guard.ts    | 12 ++-
 api/src/slices/user/user/data/user.gateway.ts |  2 +-
 api/src/slices/user/user/data/user.mapper.ts  | 25 +++--
 api/src/slices/user/user/domain/user.types.ts | 36 ++++++-
 .../slices/user/user/dtos/createUser.dto.ts   | 26 ++----
 api/src/slices/user/user/dtos/index.ts        |  2 +-
 .../slices/user/user/dtos/updateUser.dto.ts   |  6 +-
 .../user/user/dtos/updateUserRole.dto.ts      | 14 +++
 .../user/user/dtos/updateUserRoles.dto.ts     | 16 ----
 api/src/slices/user/user/dtos/user.dto.ts     |  5 +-
 api/src/slices/user/user/user.controller.ts   | 37 ++++++--
 api/src/slices/user/user/user.prisma          |  2 +-
 .../workflow/data/argo-workflow.gateway.ts    |  2 +-
 .../common/components/layout/Provider.vue     |  5 +-
 .../api/data/repositories/api/schemas.gen.ts  | 35 ++++---
 .../api/data/repositories/api/sdk.gen.ts      | 14 +--
 .../api/data/repositories/api/types.gen.ts    | 19 ++--
 app/slices/user/auth/data/auth.mapper.ts      | 17 ++--
 app/slices/user/auth/domain/auth.types.ts     |  2 +-
 app/slices/user/auth/stores/auth.ts           |  6 +-
 bun.lock                                      | 14 ++-
 52 files changed, 456 insertions(+), 280 deletions(-)
 create mode 100644 .vscode/settings.json
 create mode 100644 admin/slices/common/components/date/TimeAgo.vue
 create mode 100644 admin/slices/common/components/date/TimeAt.vue
 create mode 100644 admin/slices/common/utils/formatDate.ts
 create mode 100644 admin/slices/common/utils/index.ts
 create mode 100644 admin/slices/setup/theme/components/ui/radio-group/RadioGroup.vue
 create mode 100644 admin/slices/setup/theme/components/ui/radio-group/RadioGroupItem.vue
 create mode 100644 admin/slices/setup/theme/components/ui/radio-group/index.ts
 create mode 100644 admin/slices/user/user/pages.ts
 create mode 100644 api/prisma/migrations/20260724131635_user_single_role/migration.sql
 create mode 100644 api/src/slices/user/user/dtos/updateUserRole.dto.ts
 delete mode 100644 api/src/slices/user/user/dtos/updateUserRoles.dto.ts

diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 00000000..42e62935
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,3 @@
+{
+    "prisma.pinToPrisma6": true
+}
\ No newline at end of file
diff --git a/admin/package.json b/admin/package.json
index b78bc01f..f9b2f036 100644
--- a/admin/package.json
+++ b/admin/package.json
@@ -21,7 +21,7 @@
     "@tanstack/vue-table": "^8.21.3",
     "@unovis/ts": "^1.6.4",
     "@unovis/vue": "^1.6.4",
-    "@vueuse/core": "^14.2.1",
+    "@vueuse/core": "^14.3.0",
     "axios": "^1",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
diff --git a/admin/slices/common/components/date/TimeAgo.vue b/admin/slices/common/components/date/TimeAgo.vue
new file mode 100644
index 00000000..560c6745
--- /dev/null
+++ b/admin/slices/common/components/date/TimeAgo.vue
@@ -0,0 +1,25 @@
+<script lang="ts" setup>
+import { useTimeAgoIntl } from '@vueuse/core';
+
+const { date, class: className } = defineProps<{
+    date: string;
+    class?: string;
+}>();
+const { locale } = useI18n();
+// Getter (not a plain Date) so it re-evaluates if `date` changes.
+const timeAgoIntl = useTimeAgoIntl(() => new Date(date || Date.now()), { locale: locale.value });
+const timeAgo = computed(() => (date ? timeAgoIntl.value : ''));
+</script>
+<template>
+    <div :class="cn('flex flex-col items-end leading-none', className)">
+        <span class="text-right">{{ formatDateTime(date) }} </span>
+        <slot v-if="date" name="value" :value="timeAgo">
+            <span class="text-xs text-muted-foreground">
+                {{ timeAgo }}
+            </span>
+        </slot>
+    </div>
+</template>
+
+
+<style></style>
\ No newline at end of file
diff --git a/admin/slices/common/components/date/TimeAt.vue b/admin/slices/common/components/date/TimeAt.vue
new file mode 100644
index 00000000..9bfce14e
--- /dev/null
+++ b/admin/slices/common/components/date/TimeAt.vue
@@ -0,0 +1,12 @@
+<script setup lang="ts">
+const props = defineProps<{
+  date?: string | null;
+}>();
+</script>
+
+<template>
+  <div class="flex flex-col items-end text-xs">
+    <TimeAgo v-if="date" :date="date" />
+    <span v-else class="text-muted-foreground">—</span>
+  </div>
+</template>
diff --git a/admin/slices/common/utils/formatDate.ts b/admin/slices/common/utils/formatDate.ts
new file mode 100644
index 00000000..10694400
--- /dev/null
+++ b/admin/slices/common/utils/formatDate.ts
@@ -0,0 +1,4 @@
+export const formatDateTime = (date?: string) => {
+    if (!date) return '';
+    return new Date(date).toLocaleString('en-US', { dateStyle: 'medium', timeStyle: 'short' });
+};
\ No newline at end of file
diff --git a/admin/slices/common/utils/index.ts b/admin/slices/common/utils/index.ts
new file mode 100644
index 00000000..60c9bc22
--- /dev/null
+++ b/admin/slices/common/utils/index.ts
@@ -0,0 +1 @@
+export * from './formatDate';
\ No newline at end of file
diff --git a/admin/slices/setup/api/data/repositories/api/schemas.gen.ts b/admin/slices/setup/api/data/repositories/api/schemas.gen.ts
index ff51c746..76385a04 100644
--- a/admin/slices/setup/api/data/repositories/api/schemas.gen.ts
+++ b/admin/slices/setup/api/data/repositories/api/schemas.gen.ts
@@ -1552,6 +1552,11 @@ export const SetAgentChannelsDtoSchema = {
   required: ["channels"],
 } as const;
 
+export const AssignableUserRoleTypesSchema = {
+  type: "string",
+  enum: ["Admin", "User"],
+} as const;
+
 export const CreateUserDtoSchema = {
   type: "object",
   properties: {
@@ -1568,12 +1573,13 @@ export const CreateUserDtoSchema = {
       example: "strongPassword1",
       minLength: 8,
     },
-    roles: {
-      type: "array",
-      example: ["User"],
-      items: {
-        $ref: "#/components/schemas/UserRoleTypes",
-      },
+    role: {
+      example: "User",
+      allOf: [
+        {
+          $ref: "#/components/schemas/AssignableUserRoleTypes",
+        },
+      ],
     },
   },
   required: ["name", "email", "password"],
@@ -1602,18 +1608,19 @@ export const UpdateUserDtoSchema = {
   },
 } as const;
 
-export const UpdateUserRolesDtoSchema = {
+export const UpdateUserRoleDtoSchema = {
   type: "object",
   properties: {
-    roles: {
-      type: "array",
-      example: ["User"],
-      items: {
-        $ref: "#/components/schemas/UserRoleTypes",
-      },
+    role: {
+      example: "User",
+      allOf: [
+        {
+          $ref: "#/components/schemas/AssignableUserRoleTypes",
+        },
+      ],
     },
   },
-  required: ["roles"],
+  required: ["role"],
 } as const;
 
 export const SaveTemplateFileDtoSchema = {
diff --git a/admin/slices/setup/api/data/repositories/api/sdk.gen.ts b/admin/slices/setup/api/data/repositories/api/sdk.gen.ts
index 66301824..0a0d8a01 100644
--- a/admin/slices/setup/api/data/repositories/api/sdk.gen.ts
+++ b/admin/slices/setup/api/data/repositories/api/sdk.gen.ts
@@ -156,7 +156,7 @@ import type {
   UserControllerRemoveData,
   UserControllerFindByIdData,
   UserControllerUpdateData,
-  UserControllerUpdateRolesData,
+  UserControllerUpdateRoleData,
   TemplateFileControllerListData,
   TemplateFileControllerReadData,
   TemplateFileControllerSaveData,
@@ -2300,7 +2300,7 @@ export class UsersService {
   }
 
   /**
-   * Invite a new user
+   * Create a user (admin sets the password)
    */
   public static userControllerCreate<ThrowOnError extends boolean = false>(
     options: Options<UserControllerCreateData, ThrowOnError>,
@@ -2352,7 +2352,7 @@ export class UsersService {
   }
 
   /**
-   * Update user (name, email, password, status). Use /roles to change roles.
+   * Update user (name, email, password, status). Use /role to change the role.
    */
   public static userControllerUpdate<ThrowOnError extends boolean = false>(
     options: Options<UserControllerUpdateData, ThrowOnError>,
@@ -2372,17 +2372,17 @@ export class UsersService {
   }
 
   /**
-   * Replace the user's roles. Owner only.
+   * Set the user's role. Owner only.
    */
-  public static userControllerUpdateRoles<ThrowOnError extends boolean = false>(
-    options: Options<UserControllerUpdateRolesData, ThrowOnError>,
+  public static userControllerUpdateRole<ThrowOnError extends boolean = false>(
+    options: Options<UserControllerUpdateRoleData, ThrowOnError>,
   ) {
     return (options.client ?? _heyApiClient).put<
       unknown,
       unknown,
       ThrowOnError
     >({
-      url: "/users/{id}/roles",
+      url: "/users/{id}/role",
       ...options,
       headers: {
         "Content-Type": "application/json",
diff --git a/admin/slices/setup/api/data/repositories/api/types.gen.ts b/admin/slices/setup/api/data/repositories/api/types.gen.ts
index e4d193e6..fefc72e0 100644
--- a/admin/slices/setup/api/data/repositories/api/types.gen.ts
+++ b/admin/slices/setup/api/data/repositories/api/types.gen.ts
@@ -718,11 +718,16 @@ export type SetAgentChannelsDto = {
   channels: Array<AgentChannelDto>;
 };
 
+export enum AssignableUserRoleTypes {
+  ADMIN = "Admin",
+  USER = "User",
+}
+
 export type CreateUserDto = {
   name: string;
   email: string;
   password: string;
-  roles?: Array<UserRoleTypes>;
+  role?: AssignableUserRoleTypes;
 };
 
 export type UpdateUserDto = {
@@ -732,8 +737,8 @@ export type UpdateUserDto = {
   status?: "active" | "invited" | "disabled";
 };
 
-export type UpdateUserRolesDto = {
-  roles: Array<UserRoleTypes>;
+export type UpdateUserRoleDto = {
+  role: AssignableUserRoleTypes;
 };
 
 export type SaveTemplateFileDto = {
@@ -2914,16 +2919,16 @@ export type UserControllerUpdateResponses = {
   200: unknown;
 };
 
-export type UserControllerUpdateRolesData = {
-  body: UpdateUserRolesDto;
+export type UserControllerUpdateRoleData = {
+  body: UpdateUserRoleDto;
   path: {
     id: string;
   };
   query?: never;
-  url: "/users/{id}/roles";
+  url: "/users/{id}/role";
 };
 
-export type UserControllerUpdateRolesResponses = {
+export type UserControllerUpdateRoleResponses = {
   200: unknown;
 };
 
diff --git a/admin/slices/setup/theme/components/ui/radio-group/RadioGroup.vue b/admin/slices/setup/theme/components/ui/radio-group/RadioGroup.vue
new file mode 100644
index 00000000..6f6c27a4
--- /dev/null
+++ b/admin/slices/setup/theme/components/ui/radio-group/RadioGroup.vue
@@ -0,0 +1,24 @@
+<script setup lang="ts">
+import type { RadioGroupRootEmits, RadioGroupRootProps } from "reka-ui"
+import type { HTMLAttributes } from "vue"
+import { reactiveOmit } from "@vueuse/core"
+import { RadioGroupRoot, useForwardPropsEmits } from "reka-ui"
+import { cn } from '#theme/utils'
+
+const props = defineProps<RadioGroupRootProps & { class?: HTMLAttributes["class"] }>()
+const emits = defineEmits<RadioGroupRootEmits>()
+
+const delegatedProps = reactiveOmit(props, "class")
+
+const forwarded = useForwardPropsEmits(delegatedProps, emits)
+</script>
+
+<template>
+  <RadioGroupRoot
+    data-slot="radio-group"
+    v-bind="forwarded"
+    :class="cn('grid gap-3', props.class)"
+  >
+    <slot />
+  </RadioGroupRoot>
+</template>
diff --git a/admin/slices/setup/theme/components/ui/radio-group/RadioGroupItem.vue b/admin/slices/setup/theme/components/ui/radio-group/RadioGroupItem.vue
new file mode 100644
index 00000000..31544ecf
--- /dev/null
+++ b/admin/slices/setup/theme/components/ui/radio-group/RadioGroupItem.vue
@@ -0,0 +1,31 @@
+<script setup lang="ts">
+import type { RadioGroupItemProps } from "reka-ui"
+import type { HTMLAttributes } from "vue"
+import { reactiveOmit } from "@vueuse/core"
+import { Circle } from "lucide-vue-next"
+import { RadioGroupIndicator, RadioGroupItem, useForwardProps } from "reka-ui"
+import { cn } from '#theme/utils'
+
+const props = defineProps<RadioGroupItemProps & { class?: HTMLAttributes["class"] }>()
+
+const delegatedProps = reactiveOmit(props, "class")
+
+const forwardedProps = useForwardProps(delegatedProps)
+</script>
+
+<template>
+  <RadioGroupItem
+    data-slot="radio-group-item"
+    v-bind="forwardedProps"
+    :class="
+      cn('border-input text-primary focus-visible:border-ring focus-visible:ring-ring/50 aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive aspect-square size-4 shrink-0 rounded-full border shadow-xs transition-[color,box-shadow] outline-none focus-visible:ring-[3px] disabled:cursor-not-allowed disabled:opacity-50',
+         props.class)"
+  >
+    <RadioGroupIndicator
+      data-slot="radio-group-indicator"
+      class="relative flex items-center justify-center"
+    >
+      <Circle class="fill-primary absolute top-1/2 left-1/2 size-2 -translate-x-1/2 -translate-y-1/2" />
+    </RadioGroupIndicator>
+  </RadioGroupItem>
+</template>
diff --git a/admin/slices/setup/theme/components/ui/radio-group/index.ts b/admin/slices/setup/theme/components/ui/radio-group/index.ts
new file mode 100644
index 00000000..7cb0e3b1
--- /dev/null
+++ b/admin/slices/setup/theme/components/ui/radio-group/index.ts
@@ -0,0 +1,2 @@
+export { default as RadioGroup } from "./RadioGroup.vue"
+export { default as RadioGroupItem } from "./RadioGroupItem.vue"
diff --git a/admin/slices/user/auth/data/auth.mapper.ts b/admin/slices/user/auth/data/auth.mapper.ts
index 974b847f..73a650d9 100644
--- a/admin/slices/user/auth/data/auth.mapper.ts
+++ b/admin/slices/user/auth/data/auth.mapper.ts
@@ -4,7 +4,7 @@ const EMPTY_USER: IAuthUser = {
   id: '',
   name: '',
   email: '',
-  roles: [],
+  role: '',
   status: '',
 };
 
@@ -22,9 +22,7 @@ export class AuthMapper {
       id: o.id,
       name: str(o.name),
       email: str(o.email),
-      roles: Array.isArray(o.roles)
-        ? o.roles.filter((r): r is string => typeof r === 'string')
-        : [],
+      role: str(o.role),
       status: str(o.status),
     };
   }
diff --git a/admin/slices/user/auth/domain/auth.types.ts b/admin/slices/user/auth/domain/auth.types.ts
index 08046456..15b7146b 100644
--- a/admin/slices/user/auth/domain/auth.types.ts
+++ b/admin/slices/user/auth/domain/auth.types.ts
@@ -4,7 +4,7 @@ export interface IAuthUser {
   id: string;
   name: string;
   email: string;
-  roles: string[];
+  role: string;
   status: string;
 }
 
diff --git a/admin/slices/user/auth/stores/auth.ts b/admin/slices/user/auth/stores/auth.ts
index 45477fe7..3b077772 100644
--- a/admin/slices/user/auth/stores/auth.ts
+++ b/admin/slices/user/auth/stores/auth.ts
@@ -22,9 +22,7 @@ export const useAuthStore = defineStore('auth', () => {
 
   const isAuthenticated = computed(() => !!accessToken.value);
   const hasAdminAccess = computed(() =>
-    !!user.value?.roles?.some((role) =>
-      (ADMIN_ROLES as readonly string[]).includes(role),
-    ),
+    (ADMIN_ROLES as readonly string[]).includes(user.value?.role ?? ''),
   );
 
   function applyToken(token: string | null) {
diff --git a/admin/slices/user/user/components/user/create/Provider.vue b/admin/slices/user/user/components/user/create/Provider.vue
index 6ffcbc59..2d985c7d 100644
--- a/admin/slices/user/user/components/user/create/Provider.vue
+++ b/admin/slices/user/user/components/user/create/Provider.vue
@@ -27,13 +27,12 @@ function onCancel() {
     </NuxtLink>
 
     <div>
-      <h1 class="text-2xl font-semibold">Invite user</h1>
+      <h1 class="text-2xl font-semibold">Create user</h1>
       <p class="text-sm text-muted-foreground">Grant access to this workspace.</p>
     </div>
 
-    <UserForm
+    <UserItemForm
       :submitting="submitting"
-      submit-label="Send invite"
       @submit="onSubmit"
       @cancel="onCancel"
     />
diff --git a/admin/slices/user/user/components/user/edit/Provider.vue b/admin/slices/user/user/components/user/edit/Provider.vue
index db0d0e62..8de121cf 100644
--- a/admin/slices/user/user/components/user/edit/Provider.vue
+++ b/admin/slices/user/user/components/user/edit/Provider.vue
@@ -14,14 +14,9 @@ const { data: user, pending } = await useAsyncData(
   () => userStore.fetchById(props.id),
 );
 
-const submitting = ref(false);
+const roleLocked = computed(() => user.value?.role === UserRoleTypes.Owner);
 
-function rolesEqual(a: UserRoleTypes[], b: UserRoleTypes[]) {
-  if (a.length !== b.length) return false;
-  const sa = [...a].sort();
-  const sb = [...b].sort();
-  return sa.every((r, i) => r === sb[i]);
-}
+const submitting = ref(false);
 
 async function onSubmit(values: ICreateUserData) {
   if (!user.value) return;
@@ -31,10 +26,10 @@ async function onSubmit(values: ICreateUserData) {
   if (values.email && values.email !== user.value.email) patch.email = values.email;
   if (values.password) patch.password = values.password;
 
-  const rolesChanged = !rolesEqual(values.roles, user.value.roles);
+  const roleChanged = !roleLocked.value && values.role !== user.value.role;
   const profileChanged = Object.keys(patch).length > 0;
 
-  if (!rolesChanged && !profileChanged) {
+  if (!roleChanged && !profileChanged) {
     await navigateTo(`/users/${props.id}`);
     return;
   }
@@ -42,7 +37,7 @@ async function onSubmit(values: ICreateUserData) {
   submitting.value = true;
   try {
     if (profileChanged) await userStore.update(props.id, patch);
-    if (rolesChanged) await userStore.updateRoles(props.id, values.roles);
+    if (roleChanged) await userStore.updateRole(props.id, values.role);
   } finally {
     submitting.value = false;
   }
@@ -68,18 +63,18 @@ function onCancel() {
     <template v-else-if="user">
       <div>
         <h1 class="text-2xl font-semibold">Edit {{ user.name }}</h1>
-        <p class="text-sm text-muted-foreground">Update profile and roles. The Owner role cannot be changed here.</p>
+        <p class="text-sm text-muted-foreground">Update profile and role. The Owner role cannot be changed.</p>
       </div>
 
-      <UserForm
+      <UserItemForm
         mode="edit"
         :submitting="submitting"
-        :disabled-roles="[UserRoleTypes.Owner]"
+        :role-locked="roleLocked"
         :initial-values="{
           name: user.name,
           email: user.email,
           password: '',
-          roles: user.roles,
+          role: user.role,
         }"
         @submit="onSubmit"
         @cancel="onCancel"
diff --git a/admin/slices/user/user/components/user/item/Form.vue b/admin/slices/user/user/components/user/item/Form.vue
index 2cae1225..2a5e032c 100644
--- a/admin/slices/user/user/components/user/item/Form.vue
+++ b/admin/slices/user/user/components/user/item/Form.vue
@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import {
-  ALL_USER_ROLES,
+  ASSIGNABLE_USER_ROLES,
   UserRoleTypes,
   type ICreateUserData,
 } from '#user/domain/user.types';
@@ -9,20 +9,17 @@ const props = withDefaults(
   defineProps<{
     mode?: 'create' | 'edit';
     initialValues?: Partial<ICreateUserData>;
-    showRoles?: boolean;
-    disabledRoles?: UserRoleTypes[];
+    showRole?: boolean;
+    // Editing the Owner: the role is fixed — render a badge instead of the picker.
+    roleLocked?: boolean;
     submitLabel?: string;
     submitting?: boolean;
     cardTitle?: string;
     cardDescription?: string;
   }>(),
-  { mode: 'create', showRoles: true, disabledRoles: () => [] },
+  { mode: 'create', showRole: true, roleLocked: false },
 );
 
-function isRoleDisabled(role: UserRoleTypes) {
-  return props.disabledRoles.includes(role);
-}
-
 const emit = defineEmits<{
   submit: [values: ICreateUserData];
   cancel: [];
@@ -32,27 +29,13 @@ const form = reactive<ICreateUserData>({
   name: props.initialValues?.name ?? '',
   email: props.initialValues?.email ?? '',
   password: props.initialValues?.password ?? '',
-  roles: props.initialValues?.roles?.length
-    ? [...props.initialValues.roles]
-    : [UserRoleTypes.User],
+  role: props.initialValues?.role ?? UserRoleTypes.User,
 });
 
 const errors = reactive<
-  Partial<Record<'name' | 'email' | 'password' | 'roles', string>>
+  Partial<Record<'name' | 'email' | 'password', string>>
 >({});
 
-function isChecked(role: UserRoleTypes) {
-  return form.roles.includes(role);
-}
-
-function toggleRole(role: UserRoleTypes, checked: boolean) {
-  if (checked) {
-    if (!form.roles.includes(role)) form.roles = [...form.roles, role];
-  } else {
-    form.roles = form.roles.filter((r) => r !== role);
-  }
-}
-
 function validate() {
   errors.name = form.name.trim() ? undefined : 'Name is required';
   const email = form.email.trim();
@@ -69,8 +52,7 @@ function validate() {
     else errors.password = undefined;
   }
 
-  errors.roles = props.showRoles && !form.roles.length ? 'Pick at least one role' : undefined;
-  return !errors.name && !errors.email && !errors.password && !errors.roles;
+  return !errors.name && !errors.email && !errors.password;
 }
 
 function onSubmit() {
@@ -79,7 +61,7 @@ function onSubmit() {
     name: form.name.trim(),
     email: form.email.trim(),
     password: form.password,
-    roles: [...form.roles],
+    role: form.role,
   });
 }
 </script>
@@ -88,13 +70,13 @@ function onSubmit() {
   <form class="flex flex-col gap-6" @submit.prevent="onSubmit">
     <Card>
       <CardHeader>
-        <CardTitle>{{ cardTitle ?? (mode === 'edit' ? 'Profile' : 'Invite') }}</CardTitle>
+        <CardTitle>{{ cardTitle ?? (mode === 'edit' ? 'Profile' : 'New user') }}</CardTitle>
         <CardDescription>
           {{
             cardDescription ??
             (mode === 'edit'
               ? 'Update the user\'s profile.'
-              : 'An invitation email will be sent to the address below.')
+              : 'Set a password and share it with the user — no email is sent.')
           }}
         </CardDescription>
       </CardHeader>
@@ -121,29 +103,32 @@ function onSubmit() {
           />
           <p v-if="errors.password" class="text-xs text-destructive">{{ errors.password }}</p>
         </div>
-        <div v-if="showRoles" class="grid gap-2">
-          <Label>Roles</Label>
-          <p class="text-xs text-muted-foreground">
-            A user can hold any combination. Owner can change other users' roles.
-          </p>
-          <div class="flex flex-wrap gap-4 pt-1">
-            <label
-              v-for="role in ALL_USER_ROLES"
-              :key="role"
-              :for="`role-${role}`"
-              class="flex items-center gap-2 text-sm"
-              :class="{ 'opacity-60': isRoleDisabled(role) }"
-            >
-              <Checkbox
-                :id="`role-${role}`"
-                :model-value="isChecked(role)"
-                :disabled="isRoleDisabled(role)"
-                @update:model-value="(v: boolean | 'indeterminate') => toggleRole(role, v === true)"
-              />
-              {{ role }}
-            </label>
-          </div>
-          <p v-if="errors.roles" class="text-xs text-destructive">{{ errors.roles }}</p>
+        <div v-if="showRole" class="grid gap-2">
+          <Label>Role</Label>
+          <template v-if="roleLocked">
+            <div class="pt-1">
+              <Badge variant="secondary">{{ form.role }}</Badge>
+            </div>
+            <p class="text-xs text-muted-foreground">
+              The Owner role is fixed — it cannot be granted or revoked.
+            </p>
+          </template>
+          <template v-else>
+            <p class="text-xs text-muted-foreground">
+              Admins can manage the workspace; the single Owner is set at install time.
+            </p>
+            <RadioGroup v-model="form.role" class="flex flex-wrap gap-4 pt-1">
+              <label
+                v-for="role in ASSIGNABLE_USER_ROLES"
+                :key="role"
+                :for="`role-${role}`"
+                class="flex items-center gap-2 text-sm"
+              >
+                <RadioGroupItem :id="`role-${role}`" :value="role" />
+                {{ role }}
+              </label>
+            </RadioGroup>
+          </template>
         </div>
       </CardContent>
     </Card>
@@ -152,8 +137,8 @@ function onSubmit() {
       <Button type="submit" :disabled="submitting">
         {{
           submitting
-            ? (mode === 'edit' ? 'Saving…' : 'Sending…')
-            : (submitLabel ?? (mode === 'edit' ? 'Save' : 'Send invite'))
+            ? (mode === 'edit' ? 'Saving…' : 'Creating…')
+            : (submitLabel ?? (mode === 'edit' ? 'Save' : 'Create user'))
         }}
       </Button>
       <Button type="button" variant="ghost" @click="emit('cancel')">Cancel</Button>
diff --git a/admin/slices/user/user/components/user/item/Provider.vue b/admin/slices/user/user/components/user/item/Provider.vue
index 545e891e..c160838b 100644
--- a/admin/slices/user/user/components/user/item/Provider.vue
+++ b/admin/slices/user/user/components/user/item/Provider.vue
@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import { UserStatusTypes, UserRoleTypes } from '#user/domain/user.types';
+import {IconArrowLeft} from '@tabler/icons-vue';
 
 const props = defineProps<{ id: string }>();
 const userStore = useUserStore();
@@ -51,7 +52,7 @@ async function onRemove() {
           <Button
             variant="ghost"
             class="text-destructive"
-            :disabled="user.roles.includes(UserRoleTypes.Owner)"
+            :disabled="user.role === UserRoleTypes.Owner"
             @click="confirmRemoveOpen = true"
           >
             Remove
@@ -75,15 +76,9 @@ async function onRemove() {
         <CardContent>
           <dl class="grid grid-cols-1 gap-4 sm:grid-cols-2">
             <div>
-              <dt class="text-xs text-muted-foreground">Roles</dt>
-              <dd class="mt-1 flex flex-wrap gap-1">
-                <Badge
-                  v-for="role in user.roles"
-                  :key="role"
-                  variant="secondary"
-                >
-                  {{ role }}
-                </Badge>
+              <dt class="text-xs text-muted-foreground">Role</dt>
+              <dd class="mt-1">
+                <Badge variant="secondary">{{ user.role }}</Badge>
               </dd>
             </div>
             <div>
diff --git a/admin/slices/user/user/components/user/list/Provider.vue b/admin/slices/user/user/components/user/list/Provider.vue
index 918dae9b..251b196f 100644
--- a/admin/slices/user/user/components/user/list/Provider.vue
+++ b/admin/slices/user/user/components/user/list/Provider.vue
@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import { UserStatusTypes, UserRoleTypes, type IUserData } from '#user/domain/user.types';
+import { pages } from '#user/pages';
 
 const userStore = useUserStore();
 
@@ -39,7 +40,7 @@ async function onRemove() {
         <p class="text-sm text-muted-foreground">People with access to this workspace.</p>
       </div>
       <Button as-child>
-        <NuxtLink to="/users/create">Invite user</NuxtLink>
+        <NuxtLink :to="pages.userCreate">Create user</NuxtLink>
       </Button>
     </div>
 
@@ -52,7 +53,7 @@ async function onRemove() {
             <TableHead>Name</TableHead>
             <TableHead>Role</TableHead>
             <TableHead>Status</TableHead>
-            <TableHead>Joined</TableHead>
+            <TableHead class="text-right">Joined</TableHead>
             <TableHead class="text-right">Actions</TableHead>
           </TableRow>
         </TableHeader>
@@ -61,7 +62,7 @@ async function onRemove() {
             v-for="user in users"
             :key="user.id"
             class="cursor-pointer"
-            @click="navigateTo(`/users/${user.id}`)"
+            @click="navigateTo(pages.user.replace(':id', user.id))"
           >
             <TableCell>
               <div class="flex items-center gap-3">
@@ -75,32 +76,26 @@ async function onRemove() {
               </div>
             </TableCell>
             <TableCell>
-              <div class="flex flex-wrap gap-1">
-                <Badge
-                  v-for="role in user.roles"
-                  :key="role"
-                  variant="secondary"
-                >
-                  {{ role }}
-                </Badge>
-              </div>
+              <Badge variant="secondary">{{ user.role }}</Badge>
             </TableCell>
             <TableCell>
               <Badge :variant="statusVariant[user.status]" class="capitalize">
                 {{ user.status }}
               </Badge>
             </TableCell>
-            <TableCell class="text-muted-foreground">
-              {{ new Date(user.createdAt).toLocaleDateString(undefined, { dateStyle: 'medium' }) }}
+            <TableCell>
+              <DateTimeAgo :date="user.createdAt" />
             </TableCell>
             <TableCell @click.stop>
               <div class="flex justify-end gap-2">
-                <Button size="sm" variant="outline">Edit</Button>
+                <Button size="sm" variant="outline"
+                @click="navigateTo(pages.userEdit.replace(':id', user.id))"
+                >Edit</Button>
                 <Button
                   size="sm"
                   variant="ghost"
                   class="text-destructive"
-                  :disabled="user.roles.includes(UserRoleTypes.Owner)"
+                  :disabled="user.role === UserRoleTypes.Owner"
                   @click="pendingRemoval = user"
                 >
                   Remove
diff --git a/admin/slices/user/user/data/user.gateway.ts b/admin/slices/user/user/data/user.gateway.ts
index c9b1bf2d..76aa9e19 100644
--- a/admin/slices/user/user/data/user.gateway.ts
+++ b/admin/slices/user/user/data/user.gateway.ts
@@ -46,13 +46,13 @@ export class UserGateway extends BaseGateway implements IUserGateway {
     });
   }
 
-  updateRoles(id: string, roles: UserRoleTypes[]): Promise<IUserData> {
+  updateRole(id: string, role: UserRoleTypes): Promise<IUserData> {
     return this.execute(async () => {
-      const res = await UsersService.userControllerUpdateRoles({
+      const res = await UsersService.userControllerUpdateRole({
         path: { id },
-        body: { roles: this.mapper.toRolesBody(roles) },
+        body: { role: this.mapper.toRoleBody(role) },
       });
-      return this.entityOrThrow(res.data, 'Update roles');
+      return this.entityOrThrow(res.data, 'Update role');
     });
   }
 
diff --git a/admin/slices/user/user/data/user.mapper.ts b/admin/slices/user/user/data/user.mapper.ts
index 6dfcfa85..1e2a4b41 100644
--- a/admin/slices/user/user/data/user.mapper.ts
+++ b/admin/slices/user/user/data/user.mapper.ts
@@ -19,7 +19,7 @@ function str(value: unknown): string {
 
 /**
  * Maps the users API onto domain shapes. The generated wire enums share the
- * domain enums' string values but not their TS identity, so role/status arrays
+ * domain enums' string values but not their TS identity, so role/status values
  * are cast at the DTO boundary.
  */
 export class UserMapper {
@@ -33,7 +33,7 @@ export class UserMapper {
       name,
       email: str(o.email),
       initials: this.toInitials(name),
-      roles: this.toRoles(o.roles),
+      role: this.toRole(o.role),
       status: this.toStatus(o.status),
       createdAt: str(o.createdAt),
     };
@@ -51,7 +51,7 @@ export class UserMapper {
       name: input.name,
       email: input.email,
       password: input.password,
-      roles: input.roles as unknown as CreateUserDto['roles'],
+      role: input.role as unknown as CreateUserDto['role'],
     };
   }
 
@@ -64,15 +64,14 @@ export class UserMapper {
     };
   }
 
-  toRolesBody(roles: UserRoleTypes[]): NonNullable<CreateUserDto['roles']> {
-    return roles as unknown as NonNullable<CreateUserDto['roles']>;
+  toRoleBody(role: UserRoleTypes): NonNullable<CreateUserDto['role']> {
+    return role as unknown as NonNullable<CreateUserDto['role']>;
   }
 
-  private toRoles(raw: unknown): UserRoleTypes[] {
-    if (!Array.isArray(raw)) return [];
-    return raw.filter(
-      (r): r is UserRoleTypes => typeof r === 'string' && ROLE_VALUES.has(r),
-    );
+  private toRole(raw: unknown): UserRoleTypes {
+    return typeof raw === 'string' && ROLE_VALUES.has(raw)
+      ? (raw as UserRoleTypes)
+      : UserRoleTypes.User;
   }
 
   private toStatus(raw: unknown): UserStatusTypes {
diff --git a/admin/slices/user/user/domain/user.gateway.ts b/admin/slices/user/user/domain/user.gateway.ts
index 7b03f961..72a46025 100644
--- a/admin/slices/user/user/domain/user.gateway.ts
+++ b/admin/slices/user/user/domain/user.gateway.ts
@@ -11,6 +11,6 @@ export abstract class IUserGateway {
   abstract findById(id: string): Promise<IUserData | null>;
   abstract create(input: ICreateUserData): Promise<IUserData>;
   abstract update(id: string, input: IUpdateUserData): Promise<IUserData>;
-  abstract updateRoles(id: string, roles: UserRoleTypes[]): Promise<IUserData>;
+  abstract updateRole(id: string, role: UserRoleTypes): Promise<IUserData>;
   abstract remove(id: string): Promise<void>;
 }
diff --git a/admin/slices/user/user/domain/user.service.ts b/admin/slices/user/user/domain/user.service.ts
index 308ba121..5cfdf3ec 100644
--- a/admin/slices/user/user/domain/user.service.ts
+++ b/admin/slices/user/user/domain/user.service.ts
@@ -26,8 +26,8 @@ export class UserService {
     return this.gateway.update(id, input);
   }
 
-  updateRoles(id: string, roles: UserRoleTypes[]): Promise<IUserData> {
-    return this.gateway.updateRoles(id, roles);
+  updateRole(id: string, role: UserRoleTypes): Promise<IUserData> {
+    return this.gateway.updateRole(id, role);
   }
 
   remove(id: string): Promise<void> {
diff --git a/admin/slices/user/user/domain/user.types.ts b/admin/slices/user/user/domain/user.types.ts
index af86398b..6468912d 100644
--- a/admin/slices/user/user/domain/user.types.ts
+++ b/admin/slices/user/user/domain/user.types.ts
@@ -12,6 +12,13 @@ export const ALL_USER_ROLES: UserRoleTypes[] = [
   UserRoleTypes.User,
 ];
 
+// Roles an admin may assign. Owner exists once and is created at install
+// time (POST /init) — the API rejects granting or revoking it.
+export const ASSIGNABLE_USER_ROLES: UserRoleTypes[] = [
+  UserRoleTypes.Admin,
+  UserRoleTypes.User,
+];
+
 export enum UserStatusTypes {
   Active = 'active',
   Invited = 'invited',
@@ -26,7 +33,7 @@ export interface IUserData {
   // avatar UIs (userList, user detail) don't each reimplement the same
   // split/slice/uppercase logic.
   initials: string;
-  roles: UserRoleTypes[];
+  role: UserRoleTypes;
   status: UserStatusTypes;
   createdAt: string;
 }
@@ -35,7 +42,7 @@ export interface ICreateUserData {
   name: string;
   email: string;
   password: string;
-  roles: UserRoleTypes[];
+  role: UserRoleTypes;
 }
 
 export interface IUpdateUserData {
diff --git a/admin/slices/user/user/pages.ts b/admin/slices/user/user/pages.ts
new file mode 100644
index 00000000..d7ad40a0
--- /dev/null
+++ b/admin/slices/user/user/pages.ts
@@ -0,0 +1,6 @@
+export const pages = {
+    usersList: '/users',
+    userCreate: '/users/create',
+    user: '/users/:id',
+    userEdit: '/users/:id/edit',
+} as const;
diff --git a/admin/slices/user/user/stores/user.ts b/admin/slices/user/user/stores/user.ts
index bbde843a..d86f42e3 100644
--- a/admin/slices/user/user/stores/user.ts
+++ b/admin/slices/user/user/stores/user.ts
@@ -33,8 +33,8 @@ export const useUserStore = defineStore('user', () => {
     return updated;
   }
 
-  async function updateRoles(id: string, roles: UserRoleTypes[]) {
-    const updated = await getService().updateRoles(id, roles);
+  async function updateRole(id: string, role: UserRoleTypes) {
+    const updated = await getService().updateRole(id, role);
     users.value = users.value.map((u) => (u.id === id ? updated : u));
     return updated;
   }
@@ -44,5 +44,5 @@ export const useUserStore = defineStore('user', () => {
     users.value = users.value.filter((u) => u.id !== id);
   }
 
-  return { users, fetchAll, fetchById, create, update, updateRoles, remove };
+  return { users, fetchAll, fetchById, create, update, updateRole, remove };
 });
diff --git a/api/prisma/migrations/20260724131635_user_single_role/migration.sql b/api/prisma/migrations/20260724131635_user_single_role/migration.sql
new file mode 100644
index 00000000..a996919e
--- /dev/null
+++ b/api/prisma/migrations/20260724131635_user_single_role/migration.sql
@@ -0,0 +1,12 @@
+-- Collapse the multi-role array to a single hierarchical role.
+-- Highest role wins: Owner > Admin > User. Legacy lowercase values
+-- (pre-20260430 single-role column) are folded in defensively.
+ALTER TABLE "User" ADD COLUMN "role" TEXT NOT NULL DEFAULT 'User';
+
+UPDATE "User" SET "role" = CASE
+  WHEN 'Owner' = ANY("roles") OR 'owner' = ANY("roles") THEN 'Owner'
+  WHEN 'Admin' = ANY("roles") OR 'admin' = ANY("roles") THEN 'Admin'
+  ELSE 'User'
+END;
+
+ALTER TABLE "User" DROP COLUMN "roles";
diff --git a/api/src/slices/setup/init/domain/init.service.ts b/api/src/slices/setup/init/domain/init.service.ts
index 03232317..6add410c 100644
--- a/api/src/slices/setup/init/domain/init.service.ts
+++ b/api/src/slices/setup/init/domain/init.service.ts
@@ -18,7 +18,7 @@ export class InitService {
 
   async getStatus(): Promise<{ requiresInit: boolean }> {
     const ownerCount = await this.prisma.user.count({
-      where: { roles: { has: UserRoleTypes.Owner } },
+      where: { role: UserRoleTypes.Owner },
     });
     return { requiresInit: ownerCount === 0 };
   }
@@ -38,7 +38,7 @@ export class InitService {
         name,
         email: email.toLowerCase(),
         password: await bcrypt.hash(password, BCRYPT_ROUNDS),
-        roles: [UserRoleTypes.Owner],
+        role: UserRoleTypes.Owner,
         status: 'active',
       },
     });
@@ -47,7 +47,7 @@ export class InitService {
     const payload: IAuthTokenPayload = {
       sub: user.id,
       email: user.email,
-      roles: user.roles,
+      roles: [user.role],
     };
 
     return {
diff --git a/api/src/slices/user/auth/domain/auth.service.ts b/api/src/slices/user/auth/domain/auth.service.ts
index 1f87ca98..61e21e78 100644
--- a/api/src/slices/user/auth/domain/auth.service.ts
+++ b/api/src/slices/user/auth/domain/auth.service.ts
@@ -58,7 +58,17 @@ export class AuthService {
       throw new UnauthorizedException('Account disabled');
     }
 
-    return this.issueToken(this.mapper.toEntity(record));
+    // Invited accounts are activated by their first successful sign-in —
+    // there is no separate accept-invite flow.
+    let current = record;
+    if (current.status === 'invited') {
+      current = await this.prisma.user.update({
+        where: { id: current.id },
+        data: { status: 'active' },
+      });
+    }
+
+    return this.issueToken(this.mapper.toEntity(current));
   }
 
   async register(
@@ -86,7 +96,7 @@ export class AuthService {
           name,
           email: normalizedEmail,
           password: hashed,
-          roles: [UserRoleTypes.User],
+          role: UserRoleTypes.User,
         }),
         status: 'active',
       },
@@ -108,7 +118,7 @@ export class AuthService {
     const payload: IAuthTokenPayload = {
       sub: user.id,
       email: user.email,
-      roles: user.roles,
+      roles: [user.role],
     };
     return {
       accessToken: await this.jwt.signAsync(payload),
diff --git a/api/src/slices/user/auth/domain/auth.types.ts b/api/src/slices/user/auth/domain/auth.types.ts
index 3778d1a2..6477c2d0 100644
--- a/api/src/slices/user/auth/domain/auth.types.ts
+++ b/api/src/slices/user/auth/domain/auth.types.ts
@@ -3,6 +3,8 @@ import { IUserData, UserRoleTypes } from '../../user/domain';
 export interface IAuthTokenPayload {
   sub: string;
   email: string;
+  // Always a singleton `[user.role]` for user tokens. Kept as an array for
+  // wire compat with long-lived agent service tokens and embed tokens.
   roles: UserRoleTypes[];
 }
 
diff --git a/api/src/slices/user/auth/guards/roles.guard.ts b/api/src/slices/user/auth/guards/roles.guard.ts
index 36d97b56..79a32d5b 100644
--- a/api/src/slices/user/auth/guards/roles.guard.ts
+++ b/api/src/slices/user/auth/guards/roles.guard.ts
@@ -7,12 +7,14 @@ import {
 import { Reflector } from '@nestjs/core';
 import { Request } from 'express';
 import { IAuthTokenPayload } from '../domain/auth.types';
-import { UserRoleTypes } from '../../user/domain';
+import { hasAtLeastRole, UserRoleTypes } from '../../user/domain';
 import { ROLES_METADATA_KEY } from './roles.decorator';
 
 /**
- * Pairs with @Roles(...). Allows the request when the JWT carries at least
- * one of the required roles. Must run AFTER JwtAuthGuard so that req.user is set.
+ * Pairs with @Roles(...). The decorator lists thresholds (OR-ed): the request
+ * is allowed when the JWT carries a role at or above any of them — roles are
+ * hierarchical (Owner > Admin > User), Agent is exact-match only. Must run
+ * AFTER JwtAuthGuard so that req.user is set.
  */
 @Injectable()
 export class RolesGuard implements CanActivate {
@@ -29,7 +31,9 @@ export class RolesGuard implements CanActivate {
       .switchToHttp()
       .getRequest<Request & { user?: IAuthTokenPayload }>();
     const userRoles = req.user?.roles ?? [];
-    const allowed = required.some((r) => userRoles.includes(r));
+    const allowed = required.some((needed) =>
+      userRoles.some((actual) => hasAtLeastRole(actual, needed)),
+    );
     if (!allowed) {
       throw new ForbiddenException('Insufficient role');
     }
diff --git a/api/src/slices/user/user/data/user.gateway.ts b/api/src/slices/user/user/data/user.gateway.ts
index b46e40c7..e42cefac 100644
--- a/api/src/slices/user/user/data/user.gateway.ts
+++ b/api/src/slices/user/user/data/user.gateway.ts
@@ -49,7 +49,7 @@ export class UserGateway extends IUserGateway {
         ...(data.password && {
           password: await bcrypt.hash(data.password, BCRYPT_ROUNDS),
         }),
-        ...(data.roles && { roles: this.mapper.normalizeRoles(data.roles) }),
+        ...(data.role && { role: this.mapper.toAssignableRole(data.role) }),
         ...(data.status && { status: data.status }),
       },
     });
diff --git a/api/src/slices/user/user/data/user.mapper.ts b/api/src/slices/user/user/data/user.mapper.ts
index 1399dc23..877deed2 100644
--- a/api/src/slices/user/user/data/user.mapper.ts
+++ b/api/src/slices/user/user/data/user.mapper.ts
@@ -5,9 +5,11 @@ import {
   ICreateUserData,
   UserRoleTypes,
   ALL_USER_ROLES,
+  ASSIGNABLE_USER_ROLES,
 } from '../domain';
 
 const VALID_ROLES = new Set<string>(ALL_USER_ROLES);
+const ASSIGNABLE_ROLES = new Set<string>(ASSIGNABLE_USER_ROLES);
 
 @Injectable()
 export class UserMapper {
@@ -16,7 +18,7 @@ export class UserMapper {
       id: record.id,
       name: record.name,
       email: record.email,
-      roles: this.normalizeRoles(record.roles),
+      role: this.toRole(record.role),
       status: record.status as IUserData['status'],
       createdAt: record.createdAt,
       updatedAt: record.updatedAt,
@@ -29,17 +31,22 @@ export class UserMapper {
       name: data.name,
       email: data.email.toLowerCase(),
       password: data.password,
-      roles: this.normalizeRoles(data.roles ?? [UserRoleTypes.User]),
+      role: this.toAssignableRole(data.role),
       status: 'invited',
     };
   }
 
-  /** Drop unknown values, dedupe, fall back to ['User'] when empty. */
-  normalizeRoles(roles: readonly string[] | null | undefined): UserRoleTypes[] {
-    if (!roles?.length) return [UserRoleTypes.User];
-    const filtered = Array.from(
-      new Set(roles.filter((r): r is UserRoleTypes => VALID_ROLES.has(r))),
-    );
-    return filtered.length ? filtered : [UserRoleTypes.User];
+  /** Any valid enum member (Owner included — stored rows carry it), else User. */
+  toRole(role: string | null | undefined): UserRoleTypes {
+    return role && VALID_ROLES.has(role)
+      ? (role as UserRoleTypes)
+      : UserRoleTypes.User;
+  }
+
+  /** Only Admin/User can be written through create/update paths, else User. */
+  toAssignableRole(role: string | null | undefined): UserRoleTypes {
+    return role && ASSIGNABLE_ROLES.has(role)
+      ? (role as UserRoleTypes)
+      : UserRoleTypes.User;
   }
 }
diff --git a/api/src/slices/user/user/domain/user.types.ts b/api/src/slices/user/user/domain/user.types.ts
index 44c8b7c7..72623c11 100644
--- a/api/src/slices/user/user/domain/user.types.ts
+++ b/api/src/slices/user/user/domain/user.types.ts
@@ -16,11 +16,41 @@ export const ALL_USER_ROLES: UserRoleTypes[] = [
   UserRoleTypes.Agent,
 ];
 
+/**
+ * Roles an admin may assign to a user. Owner exists only once and is created
+ * exclusively via POST /init; Agent lives only inside JWTs.
+ */
+export const ASSIGNABLE_USER_ROLES = [
+  UserRoleTypes.Admin,
+  UserRoleTypes.User,
+] as const;
+
+export const ROLE_LEVELS: Record<UserRoleTypes, number> = {
+  [UserRoleTypes.Owner]: 3,
+  [UserRoleTypes.Admin]: 2,
+  [UserRoleTypes.User]: 1,
+  // Outside the hierarchy — matched exactly, never by level.
+  [UserRoleTypes.Agent]: 0,
+};
+
+/**
+ * Hierarchical role check: Owner > Admin > User, a higher role implies the
+ * lower ones. Agent is exact-match only, in both directions.
+ */
+export function hasAtLeastRole(
+  actual: UserRoleTypes,
+  required: UserRoleTypes,
+): boolean {
+  if (required === UserRoleTypes.Agent) return actual === UserRoleTypes.Agent;
+  if (actual === UserRoleTypes.Agent) return false;
+  return ROLE_LEVELS[actual] >= ROLE_LEVELS[required];
+}
+
 export interface IUserData {
   id: string;
   name: string;
   email: string;
-  roles: UserRoleTypes[];
+  role: UserRoleTypes;
   status: UserStatusTypes;
   createdAt: Date;
   updatedAt: Date;
@@ -30,13 +60,13 @@ export interface ICreateUserData {
   name: string;
   email: string;
   password: string;
-  roles?: UserRoleTypes[];
+  role?: UserRoleTypes;
 }
 
 export interface IUpdateUserData {
   name?: string;
   email?: string;
   password?: string;
-  roles?: UserRoleTypes[];
+  role?: UserRoleTypes;
   status?: UserStatusTypes;
 }
diff --git a/api/src/slices/user/user/dtos/createUser.dto.ts b/api/src/slices/user/user/dtos/createUser.dto.ts
index e15d3f17..eb98ab2d 100644
--- a/api/src/slices/user/user/dtos/createUser.dto.ts
+++ b/api/src/slices/user/user/dtos/createUser.dto.ts
@@ -1,14 +1,6 @@
 import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
-import {
-  ArrayUnique,
-  IsArray,
-  IsEmail,
-  IsEnum,
-  IsOptional,
-  IsString,
-  MinLength,
-} from 'class-validator';
-import { UserRoleTypes } from '../domain';
+import { IsEmail, IsIn, IsOptional, IsString, MinLength } from 'class-validator';
+import { ASSIGNABLE_USER_ROLES, UserRoleTypes } from '../domain';
 
 export class CreateUserDto {
   @ApiProperty({ example: 'Jane Doe' })
@@ -25,15 +17,13 @@ export class CreateUserDto {
   @MinLength(8)
   password: string;
 
+  // Owner is deliberately not assignable — it exists once, created via /init.
   @ApiPropertyOptional({
-    isArray: true,
-    enum: UserRoleTypes,
-    enumName: 'UserRoleTypes',
-    example: [UserRoleTypes.User],
+    enum: ASSIGNABLE_USER_ROLES,
+    enumName: 'AssignableUserRoleTypes',
+    example: UserRoleTypes.User,
   })
   @IsOptional()
-  @IsArray()
-  @ArrayUnique()
-  @IsEnum(UserRoleTypes, { each: true })
-  roles?: UserRoleTypes[];
+  @IsIn(ASSIGNABLE_USER_ROLES)
+  role?: UserRoleTypes;
 }
diff --git a/api/src/slices/user/user/dtos/index.ts b/api/src/slices/user/user/dtos/index.ts
index f569f0cc..3f6b0baf 100644
--- a/api/src/slices/user/user/dtos/index.ts
+++ b/api/src/slices/user/user/dtos/index.ts
@@ -1,4 +1,4 @@
 export { UserDto } from './user.dto';
 export { CreateUserDto } from './createUser.dto';
 export { UpdateUserDto } from './updateUser.dto';
-export { UpdateUserRolesDto } from './updateUserRoles.dto';
+export { UpdateUserRoleDto } from './updateUserRole.dto';
diff --git a/api/src/slices/user/user/dtos/updateUser.dto.ts b/api/src/slices/user/user/dtos/updateUser.dto.ts
index da4b4747..5bbea25f 100644
--- a/api/src/slices/user/user/dtos/updateUser.dto.ts
+++ b/api/src/slices/user/user/dtos/updateUser.dto.ts
@@ -3,11 +3,11 @@ import { IsEnum, IsOptional } from 'class-validator';
 import { CreateUserDto } from './createUser.dto';
 
 /**
- * Mutable user fields *except* roles — role changes require the dedicated
- * UpdateUserRolesDto endpoint guarded by Owner.
+ * Mutable user fields *except* the role — role changes require the dedicated
+ * UpdateUserRoleDto endpoint guarded by Owner.
  */
 export class UpdateUserDto extends PartialType(
-  OmitType(CreateUserDto, ['roles'] as const),
+  OmitType(CreateUserDto, ['role'] as const),
 ) {
   @ApiPropertyOptional({ enum: ['active', 'invited', 'disabled'] })
   @IsOptional()
diff --git a/api/src/slices/user/user/dtos/updateUserRole.dto.ts b/api/src/slices/user/user/dtos/updateUserRole.dto.ts
new file mode 100644
index 00000000..0ca07182
--- /dev/null
+++ b/api/src/slices/user/user/dtos/updateUserRole.dto.ts
@@ -0,0 +1,14 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsIn } from 'class-validator';
+import { ASSIGNABLE_USER_ROLES, UserRoleTypes } from '../domain';
+
+export class UpdateUserRoleDto {
+  // Owner is deliberately not assignable — it exists once, created via /init.
+  @ApiProperty({
+    enum: ASSIGNABLE_USER_ROLES,
+    enumName: 'AssignableUserRoleTypes',
+    example: UserRoleTypes.User,
+  })
+  @IsIn(ASSIGNABLE_USER_ROLES)
+  role: UserRoleTypes;
+}
diff --git a/api/src/slices/user/user/dtos/updateUserRoles.dto.ts b/api/src/slices/user/user/dtos/updateUserRoles.dto.ts
deleted file mode 100644
index b57baf82..00000000
--- a/api/src/slices/user/user/dtos/updateUserRoles.dto.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { ApiProperty } from '@nestjs/swagger';
-import { ArrayUnique, IsArray, IsEnum } from 'class-validator';
-import { UserRoleTypes } from '../domain';
-
-export class UpdateUserRolesDto {
-  @ApiProperty({
-    isArray: true,
-    enum: UserRoleTypes,
-    enumName: 'UserRoleTypes',
-    example: [UserRoleTypes.User],
-  })
-  @IsArray()
-  @ArrayUnique()
-  @IsEnum(UserRoleTypes, { each: true })
-  roles: UserRoleTypes[];
-}
diff --git a/api/src/slices/user/user/dtos/user.dto.ts b/api/src/slices/user/user/dtos/user.dto.ts
index c36ee7c1..28fafb47 100644
--- a/api/src/slices/user/user/dtos/user.dto.ts
+++ b/api/src/slices/user/user/dtos/user.dto.ts
@@ -12,12 +12,11 @@ export class UserDto {
   email: string;
 
   @ApiProperty({
-    isArray: true,
     enum: UserRoleTypes,
     enumName: 'UserRoleTypes',
-    example: [UserRoleTypes.User],
+    example: UserRoleTypes.User,
   })
-  roles: UserRoleTypes[];
+  role: UserRoleTypes;
 
   @ApiProperty()
   status: string;
diff --git a/api/src/slices/user/user/user.controller.ts b/api/src/slices/user/user/user.controller.ts
index 1b7363d5..973d541a 100644
--- a/api/src/slices/user/user/user.controller.ts
+++ b/api/src/slices/user/user/user.controller.ts
@@ -2,6 +2,7 @@ import {
   Body,
   Controller,
   Delete,
+  ForbiddenException,
   Get,
   NotFoundException,
   Param,
@@ -11,14 +12,14 @@ import {
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { IUserGateway, UserRoleTypes } from './domain';
-import { CreateUserDto, UpdateUserDto, UpdateUserRolesDto } from './dtos';
+import { CreateUserDto, UpdateUserDto, UpdateUserRoleDto } from './dtos';
 import { JwtAuthGuard, Roles, RolesGuard } from '../auth/guards';
 
 @ApiTags('users')
 @ApiBearerAuth()
 @Controller('users')
 @UseGuards(JwtAuthGuard, RolesGuard)
-@Roles(UserRoleTypes.Owner, UserRoleTypes.Admin)
+@Roles(UserRoleTypes.Admin)
 export class UserController {
   constructor(private userGateway: IUserGateway) {}
 
@@ -37,7 +38,7 @@ export class UserController {
   }
 
   @Post()
-  @ApiOperation({ summary: 'Invite a new user' })
+  @ApiOperation({ summary: 'Create a user (admin sets the password)' })
   create(@Body() dto: CreateUserDto) {
     return this.userGateway.create(dto);
   }
@@ -45,25 +46,41 @@ export class UserController {
   @Put(':id')
   @ApiOperation({
     summary:
-      'Update user (name, email, password, status). Use /roles to change roles.',
+      'Update user (name, email, password, status). Use /role to change the role.',
   })
-  update(@Param('id') id: string, @Body() dto: UpdateUserDto) {
+  async update(@Param('id') id: string, @Body() dto: UpdateUserDto) {
+    const target = await this.getTargetOrThrow(id);
+    if (dto.status !== undefined && target.role === UserRoleTypes.Owner) {
+      throw new ForbiddenException('The Owner account status cannot be changed');
+    }
     return this.userGateway.update(id, dto);
   }
 
-  @Put(':id/roles')
+  @Put(':id/role')
   @Roles(UserRoleTypes.Owner)
-  @ApiOperation({ summary: "Replace the user's roles. Owner only." })
-  updateRoles(@Param('id') id: string, @Body() dto: UpdateUserRolesDto) {
-    return this.userGateway.update(id, { roles: dto.roles });
+  @ApiOperation({ summary: "Set the user's role. Owner only." })
+  async updateRole(@Param('id') id: string, @Body() dto: UpdateUserRoleDto) {
+    const target = await this.getTargetOrThrow(id);
+    if (target.role === UserRoleTypes.Owner) {
+      throw new ForbiddenException('The Owner role cannot be changed');
+    }
+    return this.userGateway.update(id, { role: dto.role });
   }
 
   @Delete(':id')
   @Roles(UserRoleTypes.Owner)
   @ApiOperation({ summary: 'Remove user. Owner only.' })
   async remove(@Param('id') id: string) {
+    const target = await this.getTargetOrThrow(id);
+    if (target.role === UserRoleTypes.Owner) {
+      throw new ForbiddenException('The Owner account cannot be removed');
+    }
+    await this.userGateway.delete(id);
+  }
+
+  private async getTargetOrThrow(id: string) {
     const user = await this.userGateway.findById(id);
     if (!user) throw new NotFoundException('User not found');
-    await this.userGateway.delete(id);
+    return user;
   }
 }
diff --git a/api/src/slices/user/user/user.prisma b/api/src/slices/user/user/user.prisma
index a6cd3837..f8585728 100644
--- a/api/src/slices/user/user/user.prisma
+++ b/api/src/slices/user/user/user.prisma
@@ -3,7 +3,7 @@ model User {
   name      String
   email     String   @unique
   password  String
-  roles     String[] @default(["User"])
+  role      String   @default("User")
   status    String   @default("invited")
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
diff --git a/api/src/slices/workflow/data/argo-workflow.gateway.ts b/api/src/slices/workflow/data/argo-workflow.gateway.ts
index 551135da..ab411bd8 100644
--- a/api/src/slices/workflow/data/argo-workflow.gateway.ts
+++ b/api/src/slices/workflow/data/argo-workflow.gateway.ts
@@ -69,7 +69,7 @@ export class ArgoWorkflowGateway extends IWorkflowGateway {
   private async resolveOwnerUserId(): Promise<string> {
     const all = await this.userGateway.findAll();
     const owner = all
-      .filter((u) => u.roles.includes(UserRoleTypes.Owner))
+      .filter((u) => u.role === UserRoleTypes.Owner)
       .sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime())[0];
     return owner?.id ?? 'admin';
   }
diff --git a/app/slices/common/components/layout/Provider.vue b/app/slices/common/components/layout/Provider.vue
index 671cc994..8950ac8f 100644
--- a/app/slices/common/components/layout/Provider.vue
+++ b/app/slices/common/components/layout/Provider.vue
@@ -38,11 +38,10 @@
             {{ authStore.user?.name ?? authStore.user?.email }}
           </span>
           <span
-            v-for="role in authStore.roles"
-            :key="role"
+            v-if="authStore.role"
             class="hidden sm:inline rounded bg-muted px-2 py-0.5 text-[10px] uppercase tracking-wide text-muted-foreground"
           >
-            {{ role }}
+            {{ authStore.role }}
           </span>
           <button
             type="button"
diff --git a/app/slices/setup/api/data/repositories/api/schemas.gen.ts b/app/slices/setup/api/data/repositories/api/schemas.gen.ts
index ff51c746..76385a04 100644
--- a/app/slices/setup/api/data/repositories/api/schemas.gen.ts
+++ b/app/slices/setup/api/data/repositories/api/schemas.gen.ts
@@ -1552,6 +1552,11 @@ export const SetAgentChannelsDtoSchema = {
   required: ["channels"],
 } as const;
 
+export const AssignableUserRoleTypesSchema = {
+  type: "string",
+  enum: ["Admin", "User"],
+} as const;
+
 export const CreateUserDtoSchema = {
   type: "object",
   properties: {
@@ -1568,12 +1573,13 @@ export const CreateUserDtoSchema = {
       example: "strongPassword1",
       minLength: 8,
     },
-    roles: {
-      type: "array",
-      example: ["User"],
-      items: {
-        $ref: "#/components/schemas/UserRoleTypes",
-      },
+    role: {
+      example: "User",
+      allOf: [
+        {
+          $ref: "#/components/schemas/AssignableUserRoleTypes",
+        },
+      ],
     },
   },
   required: ["name", "email", "password"],
@@ -1602,18 +1608,19 @@ export const UpdateUserDtoSchema = {
   },
 } as const;
 
-export const UpdateUserRolesDtoSchema = {
+export const UpdateUserRoleDtoSchema = {
   type: "object",
   properties: {
-    roles: {
-      type: "array",
-      example: ["User"],
-      items: {
-        $ref: "#/components/schemas/UserRoleTypes",
-      },
+    role: {
+      example: "User",
+      allOf: [
+        {
+          $ref: "#/components/schemas/AssignableUserRoleTypes",
+        },
+      ],
     },
   },
-  required: ["roles"],
+  required: ["role"],
 } as const;
 
 export const SaveTemplateFileDtoSchema = {
diff --git a/app/slices/setup/api/data/repositories/api/sdk.gen.ts b/app/slices/setup/api/data/repositories/api/sdk.gen.ts
index 66301824..0a0d8a01 100644
--- a/app/slices/setup/api/data/repositories/api/sdk.gen.ts
+++ b/app/slices/setup/api/data/repositories/api/sdk.gen.ts
@@ -156,7 +156,7 @@ import type {
   UserControllerRemoveData,
   UserControllerFindByIdData,
   UserControllerUpdateData,
-  UserControllerUpdateRolesData,
+  UserControllerUpdateRoleData,
   TemplateFileControllerListData,
   TemplateFileControllerReadData,
   TemplateFileControllerSaveData,
@@ -2300,7 +2300,7 @@ export class UsersService {
   }
 
   /**
-   * Invite a new user
+   * Create a user (admin sets the password)
    */
   public static userControllerCreate<ThrowOnError extends boolean = false>(
     options: Options<UserControllerCreateData, ThrowOnError>,
@@ -2352,7 +2352,7 @@ export class UsersService {
   }
 
   /**
-   * Update user (name, email, password, status). Use /roles to change roles.
+   * Update user (name, email, password, status). Use /role to change the role.
    */
   public static userControllerUpdate<ThrowOnError extends boolean = false>(
     options: Options<UserControllerUpdateData, ThrowOnError>,
@@ -2372,17 +2372,17 @@ export class UsersService {
   }
 
   /**
-   * Replace the user's roles. Owner only.
+   * Set the user's role. Owner only.
    */
-  public static userControllerUpdateRoles<ThrowOnError extends boolean = false>(
-    options: Options<UserControllerUpdateRolesData, ThrowOnError>,
+  public static userControllerUpdateRole<ThrowOnError extends boolean = false>(
+    options: Options<UserControllerUpdateRoleData, ThrowOnError>,
   ) {
     return (options.client ?? _heyApiClient).put<
       unknown,
       unknown,
       ThrowOnError
     >({
-      url: "/users/{id}/roles",
+      url: "/users/{id}/role",
       ...options,
       headers: {
         "Content-Type": "application/json",
diff --git a/app/slices/setup/api/data/repositories/api/types.gen.ts b/app/slices/setup/api/data/repositories/api/types.gen.ts
index e4d193e6..fefc72e0 100644
--- a/app/slices/setup/api/data/repositories/api/types.gen.ts
+++ b/app/slices/setup/api/data/repositories/api/types.gen.ts
@@ -718,11 +718,16 @@ export type SetAgentChannelsDto = {
   channels: Array<AgentChannelDto>;
 };
 
+export enum AssignableUserRoleTypes {
+  ADMIN = "Admin",
+  USER = "User",
+}
+
 export type CreateUserDto = {
   name: string;
   email: string;
   password: string;
-  roles?: Array<UserRoleTypes>;
+  role?: AssignableUserRoleTypes;
 };
 
 export type UpdateUserDto = {
@@ -732,8 +737,8 @@ export type UpdateUserDto = {
   status?: "active" | "invited" | "disabled";
 };
 
-export type UpdateUserRolesDto = {
-  roles: Array<UserRoleTypes>;
+export type UpdateUserRoleDto = {
+  role: AssignableUserRoleTypes;
 };
 
 export type SaveTemplateFileDto = {
@@ -2914,16 +2919,16 @@ export type UserControllerUpdateResponses = {
   200: unknown;
 };
 
-export type UserControllerUpdateRolesData = {
-  body: UpdateUserRolesDto;
+export type UserControllerUpdateRoleData = {
+  body: UpdateUserRoleDto;
   path: {
     id: string;
   };
   query?: never;
-  url: "/users/{id}/roles";
+  url: "/users/{id}/role";
 };
 
-export type UserControllerUpdateRolesResponses = {
+export type UserControllerUpdateRoleResponses = {
   200: unknown;
 };
 
diff --git a/app/slices/user/auth/data/auth.mapper.ts b/app/slices/user/auth/data/auth.mapper.ts
index f3ce0604..c046a835 100644
--- a/app/slices/user/auth/data/auth.mapper.ts
+++ b/app/slices/user/auth/data/auth.mapper.ts
@@ -8,7 +8,7 @@ const EMPTY_USER: IAuthUser = {
   id: '',
   name: '',
   email: '',
-  roles: [],
+  role: UserRoleTypes.User,
   status: '',
 };
 
@@ -16,8 +16,8 @@ const VALID_ROLES = new Set<string>(Object.values(UserRoleTypes));
 
 /**
  * Maps the (untyped) auth responses onto domain shapes. Reads defensively and
- * keeps only recognized roles so an unexpected backend value can't crash the
- * role checks.
+ * falls back to the lowest role so an unexpected backend value can't crash
+ * (or escalate) the role checks.
  */
 export class AuthMapper {
   toUser(raw: unknown): IAuthUser | null {
@@ -28,7 +28,7 @@ export class AuthMapper {
       id: o.id,
       name: typeof o.name === 'string' ? o.name : '',
       email: typeof o.email === 'string' ? o.email : '',
-      roles: this.toRoles(o.roles),
+      role: this.toRole(o.role),
       status: typeof o.status === 'string' ? o.status : '',
     };
   }
@@ -42,10 +42,9 @@ export class AuthMapper {
     };
   }
 
-  private toRoles(raw: unknown): UserRoleTypes[] {
-    if (!Array.isArray(raw)) return [];
-    return raw.filter(
-      (r): r is UserRoleTypes => typeof r === 'string' && VALID_ROLES.has(r),
-    );
+  private toRole(raw: unknown): UserRoleTypes {
+    return typeof raw === 'string' && VALID_ROLES.has(raw)
+      ? (raw as UserRoleTypes)
+      : UserRoleTypes.User;
   }
 }
diff --git a/app/slices/user/auth/domain/auth.types.ts b/app/slices/user/auth/domain/auth.types.ts
index cef4a429..0fb4a9f2 100644
--- a/app/slices/user/auth/domain/auth.types.ts
+++ b/app/slices/user/auth/domain/auth.types.ts
@@ -11,7 +11,7 @@ export interface IAuthUser {
   id: string;
   name: string;
   email: string;
-  roles: UserRoleTypes[];
+  role: UserRoleTypes;
   status: string;
 }
 
diff --git a/app/slices/user/auth/stores/auth.ts b/app/slices/user/auth/stores/auth.ts
index aa606bdd..ccc5a97e 100644
--- a/app/slices/user/auth/stores/auth.ts
+++ b/app/slices/user/auth/stores/auth.ts
@@ -28,11 +28,11 @@ export const useAuthStore = defineStore('auth', () => {
   const isHydrated = ref(false);
 
   const isAuthenticated = computed(() => !!accessToken.value && !!user.value);
-  const roles = computed<UserRoleTypes[]>(() => user.value?.roles ?? []);
+  const role = computed<UserRoleTypes | null>(() => user.value?.role ?? null);
 
   function hasRole(...required: UserRoleTypes[]): boolean {
     if (!required.length) return isAuthenticated.value;
-    return required.some((r) => roles.value.includes(r));
+    return required.some((r) => r === role.value);
   }
 
   function applyToken(token: string | null) {
@@ -91,7 +91,7 @@ export const useAuthStore = defineStore('auth', () => {
   return {
     accessToken,
     user,
-    roles,
+    role,
     isHydrated,
     isAuthenticated,
     hasRole,
diff --git a/bun.lock b/bun.lock
index 4dc4be35..56be044a 100644
--- a/bun.lock
+++ b/bun.lock
@@ -22,7 +22,7 @@
         "@tanstack/vue-table": "^8.21.3",
         "@unovis/ts": "^1.6.4",
         "@unovis/vue": "^1.6.4",
-        "@vueuse/core": "^14.2.1",
+        "@vueuse/core": "^14.3.0",
         "axios": "^1",
         "class-variance-authority": "^0.7.1",
         "clsx": "^2.1.1",
@@ -1469,11 +1469,11 @@
 
     "@vue/shared": ["@vue/shared@3.5.32", "", {}, "sha512-ksNyrmRQzWJJ8n3cRDuSF7zNNontuJg1YHnmWRJd2AMu8Ij2bqwiiri2lH5rHtYPZjj4STkNcgcmiQqlOjiYGg=="],
 
-    "@vueuse/core": ["@vueuse/core@14.2.1", "", { "dependencies": { "@types/web-bluetooth": "^0.0.21", "@vueuse/metadata": "14.2.1", "@vueuse/shared": "14.2.1" }, "peerDependencies": { "vue": "^3.5.0" } }, "sha512-3vwDzV+GDUNpdegRY6kzpLm4Igptq+GA0QkJ3W61Iv27YWwW/ufSlOfgQIpN6FZRMG0mkaz4gglJRtq5SeJyIQ=="],
+    "@vueuse/core": ["@vueuse/core@14.3.0", "", { "dependencies": { "@types/web-bluetooth": "^0.0.21", "@vueuse/metadata": "14.3.0", "@vueuse/shared": "14.3.0" }, "peerDependencies": { "vue": "^3.5.0" } }, "sha512-aHfz47g0ZhMtTVHmIzMVpJy8ePhhOy68GY5bv110+5DVtZ+W7BsOx+m61UNQqfrWyPztIHIanWa3E2tib3NFIw=="],
 
-    "@vueuse/metadata": ["@vueuse/metadata@14.2.1", "", {}, "sha512-1ButlVtj5Sb/HDtIy1HFr1VqCP4G6Ypqt5MAo0lCgjokrk2mvQKsK2uuy0vqu/Ks+sHfuHo0B9Y9jn9xKdjZsw=="],
+    "@vueuse/metadata": ["@vueuse/metadata@14.3.0", "", {}, "sha512-BwxmbAzwAVF50+MW57GXOUEV61nFBGnlBvrTqj49PqWJu3uw7hdu72ztXeZ33RdZtDY6kO+bfCAE1PCn88Tktw=="],
 
-    "@vueuse/shared": ["@vueuse/shared@14.2.1", "", { "peerDependencies": { "vue": "^3.5.0" } }, "sha512-shTJncjV9JTI4oVNyF1FQonetYAiTBd+Qj7cY89SWbXSkx7gyhrgtEdF2ZAVWS1S3SHlaROO6F2IesJxQEkZBw=="],
+    "@vueuse/shared": ["@vueuse/shared@14.3.0", "", { "peerDependencies": { "vue": "^3.5.0" } }, "sha512-bZpge9eSXwa4ToSiqJ7j6KRwhAsneMFoSz3LMWKQDkqimm3D/tbFlrklrs/IOqC8tEcYmXQZJ6N0UrjhBirVCg=="],
 
     "@webassemblyjs/ast": ["@webassemblyjs/ast@1.14.1", "", { "dependencies": { "@webassemblyjs/helper-numbers": "1.13.2", "@webassemblyjs/helper-wasm-bytecode": "1.13.2" } }, "sha512-nuBEDgQfm1ccRp/8bCQrx1frohyufl4JlbMMZ4P1wpeOfDhF6FQkxZJ1b/e+PLwr6X1Nhw6OLme5usuBWYBvuQ=="],
 
@@ -4025,6 +4025,10 @@
 
     "readdir-glob/minimatch": ["minimatch@5.1.9", "", { "dependencies": { "brace-expansion": "^2.0.1" } }, "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw=="],
 
+    "reka-ui/@vueuse/core": ["@vueuse/core@14.2.1", "", { "dependencies": { "@types/web-bluetooth": "^0.0.21", "@vueuse/metadata": "14.2.1", "@vueuse/shared": "14.2.1" }, "peerDependencies": { "vue": "^3.5.0" } }, "sha512-3vwDzV+GDUNpdegRY6kzpLm4Igptq+GA0QkJ3W61Iv27YWwW/ufSlOfgQIpN6FZRMG0mkaz4gglJRtq5SeJyIQ=="],
+
+    "reka-ui/@vueuse/shared": ["@vueuse/shared@14.2.1", "", { "peerDependencies": { "vue": "^3.5.0" } }, "sha512-shTJncjV9JTI4oVNyF1FQonetYAiTBd+Qj7cY89SWbXSkx7gyhrgtEdF2ZAVWS1S3SHlaROO6F2IesJxQEkZBw=="],
+
     "resolve-cwd/resolve-from": ["resolve-from@5.0.0", "", {}, "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw=="],
 
     "restore-cursor/onetime": ["onetime@5.1.2", "", { "dependencies": { "mimic-fn": "^2.1.0" } }, "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg=="],
@@ -4521,6 +4525,8 @@
 
     "readdir-glob/minimatch/brace-expansion": ["brace-expansion@2.0.3", "", { "dependencies": { "balanced-match": "^1.0.0" } }, "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA=="],
 
+    "reka-ui/@vueuse/core/@vueuse/metadata": ["@vueuse/metadata@14.2.1", "", {}, "sha512-1ButlVtj5Sb/HDtIy1HFr1VqCP4G6Ypqt5MAo0lCgjokrk2mvQKsK2uuy0vqu/Ks+sHfuHo0B9Y9jn9xKdjZsw=="],
+
     "restore-cursor/onetime/mimic-fn": ["mimic-fn@2.1.0", "", {}, "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg=="],
 
     "rollup-plugin-visualizer/open/wsl-utils": ["wsl-utils@0.3.1", "", { "dependencies": { "is-wsl": "^3.1.0", "powershell-utils": "^0.1.0" } }, "sha512-g/eziiSUNBSsdDJtCLB8bdYEUMj4jR7AGeUo96p/3dTafgjHhpF4RiCFPiRILwjQoDXx5MqkBr4fwWtR3Ky4Wg=="],