It's covered by automated tests, for manual testing: Setup Create a new role without archetype: Short name : MU Custom full name : Manager users Context types where this role may be assigned : System Allowed capabilities : moodle/site:configview & moodle/user:update Create a user "manager" and assign the previous role Test Log in as "manager" Confirm you can see Site administration > Users > Accounts > Browse list of users and access to it. Confirm that not exception error is shown Log out Log in as "admin" an edit the "Manager users" role enabling the moodle/user:delete capability and disabling moodle/user:update . Log out Log in as "manager" Confirm you can see Site administration > Users > Accounts > Browse list of users and access to it. Confirm that not exception error is shown Log out Log in as "admin"and edit "Manager users" role disabling both moodle/user:delete &   moodle/user:update capabilities. Log out Log in as "manager" Confirm you can not see Site administration > Users > Accounts > Browse list of users. Confirm that trying to access to /admin/user.php directly shown an Access denied moodle exception.