User management isn't boring, it's where you lose money
Every admin panel user CRUD looks simple until production breaks it. Here's what I learned building them wrong, then right.
I've built user management screens maybe fifty times now. PHP backends, Node.js APIs, ERPNext customizations. Every time I think it's trivial. Every time something breaks.
The first mistake: treating it like a checkbox feature. "Oh, just add user list, create form, delete button." Done. Ship it.
Then production happens.
A user deletes an admin account while that admin is still logged in. Orphaned API tokens everywhere. Cascade failures. Someone creates a user with an email that already exists in the system but soft-deleted, and now your unique constraint is lying to you. An admin bulk-deletes users and accidentally wipes their own session token.
I learned this the hard way with ERPNext customizations. ERP systems especially hate half-baked user management—your entire workflow breaks if a user disappears while they own open documents.
Here's what actually matters:
Permission layers matter. Not just checking if the user is admin. Check if they're allowed to delete that specific user. In multi-tenant setups, check they're in the same org. Sounds obvious. Gets skipped constantly.
Soft deletes save you. Hard delete that production user? Recovery is a database backup prayer. Soft delete, mark as inactive, let them be recoverable for 30 days. Your users will thank you when someone panic-deletes the wrong person.
Cascading is dangerous. Before deleting a user, what happens to their API tokens? Their audit logs? Their documents in an ERP? I've seen code that just deletes tokens silently—then integrations fail mysteriously. Make it explicit. Show what breaks before you confirm the delete.
Self-delete prevention is non-negotiable. Lock it in the UI and the API. An admin panics, fat-fingers their own delete button. You need to catch that at every layer.
Pagination isn't about performance, it's about reality. 5000 users on one page freezes the browser. Paginate. Use cursors if you can. Your frontend will handle it better.
I built this pattern into Seven Suite. Boring? Yes. Saves production incidents? Absolutely.
Don't treat admin screens like toys. They're where your system's trust lives.