Permission management would be simpler if there were a setting in patron categories that indicate whether that category of patron can have permissions. - If no, that option would not appear in the patron menu. - If patron category is changed to a category that does not allow permissions, any existing permissions should be cleared when change is saved.
On further reflections, my second suggestion above should have its own preference setting to retain current behavior. - Create a pref, like ClearPermissionsAutomatically, where it defaults to Don't, but can be set to Do if you want permissions cleared automatically when changing patron to a category that doesn't allow permissions.
+1 this is a great suggestion. Koha having the ability to clear permissions from an account when it moves from a 'permissions allowed category' into an ordinary patron category would be a huge help. Despite policies explaining otherwise, some staff members still believe that moving an ex-staff account to being an ordinary patron account revokes Koha access. I run a report to identify when this happens - but it would be very helpful if Koha could manage this automatically.