DOC-3301 RBAC clarity and nav

modules/user-access/nav.adoc

@@ -10,10 +10,10 @@
 *** xref:ldap.adoc[]
 *** xref:jwt-token.adoc[]
 ** Authorization
-*** xref:user-management.adoc[]
 *** xref:access-control-model.adoc[Access Control Model]
-*** xref:fine-grained-query-privileges.adoc[]
 *** xref:role-management.adoc[]
+*** xref:user-management.adoc[]
+*** xref:fine-grained-query-privileges.adoc[]
 *** xref:rbac-row-policy/row-policy-overview.adoc[Row Policy Overview]
 **** xref:rbac-row-policy/rbac-row-policy.adoc[Key Concepts]
 **** xref:rbac-row-policy/setup-row-policy.adoc[]

modules/user-access/pages/access-control-model.adoc

@@ -52,7 +52,7 @@ For example:
 
 * A role with `CREATE_QUERY` on graph `Social` can only create queries on graph `social`, but not on other graphs.
 In contrast, a role with `CREATE_QUERY` on the global scope can create queries on all graphs.
-* A role with `UPDATE_DATA` on the `age` attribute of the `Person` vertex on graph `Social` are allowed to run queries that update the value of the `age` attribute of `Person` vertices.
+* A role with `UPDATE_DATA` on the `age` attribute of the `Person` vertex on graph `Social` is allowed to run queries that update the value of the `age` attribute of `Person` vertices.
 * A role with `READ_DATA` on the global scope can run queries that read graph data on any graph, any type, or any attribute.
 They do not need to have privileges specifically for those graphs, types, or attributes.
 
@@ -258,7 +258,7 @@ It cannot be granted global privileges.
 
 === Built-in roles
 
-GSQL offers five built-in local roles and two built-in global roles.
+GSQL offers five built-in local roles and three built-in global roles.
 The built-in roles cannot be dropped.
 The following table details the built-in roles and their corresponding set of privileges.
 

modules/user-access/pages/fine-grained-query-privileges.adoc

@@ -80,7 +80,7 @@ The privilege "CREATE" is successfully granted on "ALL QUERIES" IN GLOBAL to rol
 Note that `UPDATE` privilege depends on `READ` privilege.
 You need to grant `READ` before `UPDATE`, and revoke `UPDATE` before `READ`.
 
-.Example: Grant `READ` and `UDPATE` privileges on existing specific query objects `q1`, `q2` in graph `g1` to user `u1`:
+.Example: Grant `READ` and `UPDATE` privileges on existing specific query objects `q1`, `q2` in graph `g1` to user `u1`:
 [console, gsql]
 ----
 GSQL > GRANT READ, UPDATE ON QUERY q1, q2 IN GRAPH g1 to u1

modules/user-access/pages/role-management.adoc

@@ -77,7 +77,7 @@ Successfully created global roles: [role1].
 
 Users with the `READ_ROLE` privilege in a scope can view the privileges on the roles in that scope.
 
-Both `SHOW GRANTS TO ROLE` and `SHOW PRVILEGE ON ROLE` shows the RBAC privileges of a role.
+Both `SHOW GRANTS TO ROLE` and `SHOW PRIVILEGE ON ROLE` shows the RBAC privileges of a role.
 
 === Syntax
 
@@ -304,7 +304,7 @@ This will revoke the `WRITE_SCHEMA` privilege from the role `role1` on graph `ex
 == Revoke type-level privileges
 You can revoke certain privileges from the type level with the Object-based revoke privilege command.
 
-Revoking a privilege at the type does not affect privileges granted at higher levels (e.g., global or graph level). For instance, if a role has `READ_DATA`` on a vertex type globally, revoking this privilege at the type level will not prevent the role from accessing the vertex type.
+Revoking a privilege at the type does not affect privileges granted at higher levels (e.g., global or graph level). For instance, if a role has `READ_DATA` on a vertex type globally, revoking this privilege at the type level will not prevent the role from accessing the vertex type.
 
 === Syntax
 
@@ -325,7 +325,7 @@ REVOKE UPDATE ON EDGE Friendship IN GRAPH Social FROM role1, role2
 == Revoke attribute-level privileges
 You can revoke certain privileges from the attribute level with the Object-based revoke privilege command.
 
-Revoking a privilege at the type does not affect privileges granted at higher levels (e.g., global, graph level or type level). For instance, if a role has `READ_DATA`` on a vertex type globally, revoking this privilege at the attribute level will not prevent the role from accessing the vertex attribute type.
+Revoking a privilege at the type does not affect privileges granted at higher levels (e.g., global, graph level or type level). For instance, if a role has `READ_DATA` on a vertex type globally, revoking this privilege at the attribute level will not prevent the role from accessing the vertex attribute type.
 
 === Syntax
 [source.wrap,gsql]

modules/user-access/pages/user-management.adoc

@@ -106,9 +106,8 @@ GSQL > create user -u user1 -p pass1
 for special case use “`“ username“`“ to include the username
 ====
 
-== View roles assignments and login attempts
-The `SHOW USER` command displays the role assignments, as well as the login attempts,  of the current user.
-If the current user has the `READ_USER` privilege
+== View users, role assignments and login activity
+The `SHOW USER` command displays information about users, including their role assignments and login activity. It displays both local users and proxy users. If the current user has the `READ_USER` privilege, information on all users is displayed. Otherwise, only the current user's information is displayed.
 
 === Syntax
 
@@ -186,18 +185,6 @@ Proxy group membership is determined during SSO login based on identity provider
 Group information may not be available until the proxy user has logged in successfully.
 ====
 
-== View users and login activity
-
-The `SHOW USER` command displays both local users and proxy users.
-
-[source,gsql]
-----
-SHOW USER
-----
-
-If the current user has the`READ_USER` privilege, information for all users (local and proxy) is displayed.
-Otherwise, only the current user is shown.
-
 == View privileges of a user or proxy group
 
 Users with the `READ_USER` privilege in a scope can view the RBAC privileges of users or proxy groups within that scope.
@@ -451,7 +438,7 @@ REVOKE <privilegeName1> (, <privilegeName2>)* ON <privilegeObjects>
 [source,text]
 ----
 GSQL > REVOKE WRITE ON ALL ROLES
-        IN GRAPH example_graph TO user1
+        IN GRAPH example_graph FROM user1
 ----
 
 This will revoke the `WRITE_ROLE` privilege from the user `user1` on graph `example_graph.`