Manual:$wgAddGroups

By default the bureaucrat user group may grant all rights, because of the following setting:

$wgGroupPermissions['bureaucrat']['userrights'] = true;

Note that groups which may only grant some rights (like bureaucrats in this example) need to have the userrights privilege set to false, otherwise they will still be able to add all groups.

$wgGroupPermissions['bureaucrat']['userrights'] = false;

Alternatively, $wgAddGroups can be defined without potentially overwriting an extension's definition:

$wgAddGroups['bureaucrat'][] = 'sysop';
$wgAddGroups['bureaucrat'][] = 'bot';

If a group can add any right (example: bureaucrats can add any right):

$wgAddGroups['bureaucrat'] = true;

If a group can add only some rights (example: bureaucrats can add only sysop and bot groups):

$wgAddGroups['bureaucrat'] = [ 'sysop', 'bot' ];

Not seeing permission checkboxes

If after setting this, you do not see the group checkboxes on the Special:Userrights page for a particular user, it might mean that they're already in that group and that the groups you are in do not allow the removal of a user from the set groups.

Once a user is in a group, defined by this setting the group checkboxes will only show up if $wgRemoveGroups is also set for the group in question.

• $wgRemoveGroups
• $wgGroupsAddToSelf
• $wgGroupsRemoveFromSelf
• $wgGroupPermissions
• Manual:User rights - information about managing and the assignment of user groups.