diff --git a/app/assets/javascripts/admin/commons/users.js b/app/assets/javascripts/admin/commons/users.js
index 5ed2861f2d..ab7a3717f9 100644
--- a/app/assets/javascripts/admin/commons/users.js
+++ b/app/assets/javascripts/admin/commons/users.js
@@ -1,34 +1,91 @@
 /*global $ */
-$(function () {
-    'use strict';
+// Affiche la cible d'un rôle et n'y propose que les options du bon type.
+// Le type attendu est porté par l'option de rôle sélectionnée
+// (data-scope-type, vide = rôle global) ; chaque option de cible porte aussi
+// son type. Aucun mapping en dur : tout vient du HTML rendu.
+window.osuny.userRoles = {
+    init: function () {
+        'use strict';
+        var rows,
+            i;
+        if (!document.body.matches('.users-edit, .users-new, .users-update, .users-create')) {
+            return;
+        }
+        rows = document.querySelectorAll('[data-user-role]');
+        for (i = 0; i < rows.length; i += 1) {
+            this.refreshRow(rows[i]);
+        }
+        this.initEvents();
+    },
+
+    initEvents: function () {
+        'use strict';
+        document.addEventListener('change', this.onChangeRole.bind(this));
+        $('#user_roles').on('cocoon:after-insert', this.onAfterInsert.bind(this));
+    },
+
+    onChangeRole: function (event) {
+        'use strict';
+        var roleSelect = event.target.closest('[data-user-role-role]');
+        if (roleSelect !== null) {
+            this.refreshRow(roleSelect.closest('[data-user-role]'));
+        }
+    },
+
+    onAfterInsert: function (event, row) {
+        'use strict';
+        this.refreshRow(row[0]);
+    },
+
+    refreshRow: function (row) {
+        'use strict';
+        var roleSelect = row.querySelector('[data-user-role-role]'),
+            roleOption = roleSelect && roleSelect.options[roleSelect.selectedIndex],
+            type = roleOption && roleOption.getAttribute('data-scope-type'),
+            container = row.querySelector('[data-user-role-scope-container]'),
+            scope = row.querySelector('[data-user-role-scope]');
 
-    var changeRole = function () {
-        var value = $('select[name="user[role]"]').val(),
-            showForRoles,
-            required;
-
-        $('*[data-show-for-roles]').each(function () {
-            showForRoles = $(this)
-                .attr('data-show-for-roles')
-                .split(',');
-            if ($.inArray(value, showForRoles) > -1) {
-                required = $(this).attr('data-required');
-                if (required) {
-                    $('input, select', this).attr('required', 'required');
-                } else {
-                    $('input, select', this).removeAttr('required');
-                }
-                $(this).show();
-            } else {
-                $(this).hide();
-                // hidden field cannot be required
-                $('input, select', this).removeAttr('required');
+        if (!type) {
+            container.classList.add('d-none');
+            return;
+        }
+        container.classList.remove('d-none');
+        this.filterScopeOptions(scope, type);
+    },
+
+    // N'affiche que les cibles du bon type et, si la cible courante n'est pas
+    // du bon type, sélectionne la première valide.
+    filterScopeOptions: function (scope, type) {
+        'use strict';
+        var options = scope.options,
+            firstMatch = null,
+            selected = scope.options[scope.selectedIndex],
+            matches,
+            i;
+
+        for (i = 0; i < options.length; i += 1) {
+            matches = options[i].getAttribute('data-scope-type') === type;
+            options[i].hidden = !matches;
+            options[i].disabled = !matches;
+            if (matches && firstMatch === null) {
+                firstMatch = options[i].value;
             }
-        });
-    };
+        }
+
+        if (!selected || selected.getAttribute('data-scope-type') !== type) {
+            scope.value = firstMatch;
+        }
+    },
 
-    if ($('body').is('.users-edit, .users-new, .users-update, .users-create')) {
-        changeRole();
-        $('select[name="user[role]"]').change(changeRole);
+    invoke: function () {
+        'use strict';
+        return {
+            init: this.init.bind(this)
+        };
     }
+}.invoke();
+
+window.addEventListener('DOMContentLoaded', function () {
+    'use strict';
+    window.osuny.userRoles.init();
 });
diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb
index 8b01237bd2..f9dc0a1317 100644
--- a/app/controllers/admin/users_controller.rb
+++ b/app/controllers/admin/users_controller.rb
@@ -81,7 +81,8 @@ def breadcrumb
 
   def user_params
     params.require(:user)
-          .permit(:email, :first_name, :last_name, :role, :language_id, :picture, :picture_delete, :picture_infos, :mobile_phone, programs_to_manage_ids: [], websites_to_manage_ids: [])
+          .permit(:email, :first_name, :last_name, :language_id, :picture, :picture_delete, :picture_infos, :mobile_phone,
+                  roles_attributes: [:id, :role, :scope_choice, :_destroy])
           .merge(university_id: current_university.id)
   end
 
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index c2c32ab025..f803610ce4 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -27,7 +27,7 @@ def render_as_plain_text(partial: nil)
   end
 
   def current_ability
-    @current_ability ||= Ability.for(current_user)
+    @current_ability ||= User::Ability.for(current_user)
   end
 
   def ensure_university
diff --git a/app/controllers/extranet/application_controller.rb b/app/controllers/extranet/application_controller.rb
index de64c15c1c..9bf99d5d51 100644
--- a/app/controllers/extranet/application_controller.rb
+++ b/app/controllers/extranet/application_controller.rb
@@ -24,11 +24,7 @@ def authorize_extranet_access!
   end
 
   def user_is_authorized?
-    user_is_more_than_visitor || user_is_alumnus || user_is_contact
-  end
-
-  def user_is_more_than_visitor
-    !current_user.visitor?
+    current_ability.can? :read, current_extranet
   end
 
   def user_is_alumnus
diff --git a/app/models/ability.rb b/app/models/ability.rb
deleted file mode 100644
index e98457ce2a..0000000000
--- a/app/models/ability.rb
+++ /dev/null
@@ -1,19 +0,0 @@
-# frozen_string_literal: true
-
-class Ability
-  include CanCan::Ability
-
-  def self.for(user)
-    "Ability::#{user.role.classify}".constantize.new user
-  end
-
-  def initialize(user)
-    @user = user ||= User.new # guest user (not logged in)
-  end
-
-  protected
-
-  def managed_websites_ids
-    @managed_websites_ids ||= @user.websites_to_manage.pluck(:communication_website_id)
-  end
-end
diff --git a/app/models/ability/visitor.rb b/app/models/ability/visitor.rb
deleted file mode 100644
index 0784040545..0000000000
--- a/app/models/ability/visitor.rb
+++ /dev/null
@@ -1,2 +0,0 @@
-class Ability::Visitor < Ability
-end
\ No newline at end of file
diff --git a/app/models/communication/website.rb b/app/models/communication/website.rb
index 6bf83679df..1307975df7 100644
--- a/app/models/communication/website.rb
+++ b/app/models/communication/website.rb
@@ -138,7 +138,7 @@ class Communication::Website < ApplicationRecord
 
   def self.organized_for(user, language, limit: 6)
     university = user.university
-    ability = ::Ability.for(user)
+    ability = ::User::Ability.for(user)
     # Favorites first
     favorites_ids = user.favorites.websites.pluck(:about_id)
     websites =  university.websites
diff --git a/app/models/emergency_message.rb b/app/models/emergency_message.rb
index c92419d4cb..7de79036db 100644
--- a/app/models/emergency_message.rb
+++ b/app/models/emergency_message.rb
@@ -53,7 +53,8 @@ def to_s
 
   def target
     users = User.all
-    users = users.where(university_id: university_id) if university_id.present? 
+    users = users.where(university_id: university_id) if university_id.present?
+    # TODO(multiroles) @pabois
     users = users.where(role: role) if role.present?
     # next lines are to prevent to send the message to multiple occurrences of the same email (as for server_admin!)
     target_user_ids = users.select("DISTINCT ON (users.email) users.email, users.id").map(&:id)
diff --git a/app/models/user.rb b/app/models/user.rb
index 4f6ae1abd4..b7bbdeba37 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -30,6 +30,7 @@
 #  reset_password_token          :string           uniquely indexed
 #  role                          :integer          default("visitor")
 #  second_factor_attempts_count  :integer          default(0)
+#  server_admin                  :boolean          default(FALSE)
 #  session_token                 :string
 #  sign_in_count                 :integer          default(0), not null
 #  totp_timestamp                :datetime
diff --git a/app/models/user/ability.rb b/app/models/user/ability.rb
new file mode 100644
index 0000000000..3714754438
--- /dev/null
+++ b/app/models/user/ability.rb
@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+class User::Ability
+  include CanCan::Ability
+
+  attr_reader :user
+
+  def self.for(user)
+    user ||= User.new # guest user (not logged in)
+    new(user)
+  end
+
+  def initialize(user)
+    @user = user ||= User.new # guest user (not logged in)
+    if user.server_admin?
+      can :manage, :all
+    else
+      # Les rôles sont fusionnés du moins au plus privilégié (cf. User#ability_roles)
+      # pour que, en cas de conflit, la règle du rôle le plus puissant — déclarée
+      # en dernier — l'emporte (CanCanCan : last rule wins).
+      user.ability_roles.each do |role_name|
+        merge "User::Ability::#{role_name.classify}".constantize.new(user)
+      end
+    end
+  end
+
+  protected
+
+  # Ids des cibles attachées à un rôle donné de l'utilisateur.
+  # Chaque ability scope ses règles aux cibles de SON rôle (cf. User#scopes_for),
+  # ce qui permet d'être par exemple author du site A et website_manager du site B
+  # sans que les périmètres ne débordent l'un sur l'autre.
+  def scoped_ids(role_name)
+    @user.scopes_for(role_name).map(&:id)
+  end
+end
diff --git a/app/models/ability/admin.rb b/app/models/user/ability/admin.rb
similarity index 99%
rename from app/models/ability/admin.rb
rename to app/models/user/ability/admin.rb
index 35c551dc83..929e7b8f45 100644
--- a/app/models/ability/admin.rb
+++ b/app/models/user/ability/admin.rb
@@ -1,4 +1,4 @@
-class Ability::Admin < Ability
+class User::Ability::Admin < User::Ability
 
   def initialize(user)
     super
diff --git a/app/models/ability/alumni_manager.rb b/app/models/user/ability/alumni_manager.rb
similarity index 97%
rename from app/models/ability/alumni_manager.rb
rename to app/models/user/ability/alumni_manager.rb
index 5b8639bb08..4720123dbb 100644
--- a/app/models/ability/alumni_manager.rb
+++ b/app/models/user/ability/alumni_manager.rb
@@ -1,4 +1,4 @@
-class Ability::AlumniManager < Ability
+class User::Ability::AlumniManager < User::Ability
 
   def initialize(user)
     super
diff --git a/app/models/ability/author.rb b/app/models/user/ability/author.rb
similarity index 96%
rename from app/models/ability/author.rb
rename to app/models/user/ability/author.rb
index b314faaea9..a90bbc50d9 100644
--- a/app/models/ability/author.rb
+++ b/app/models/user/ability/author.rb
@@ -1,4 +1,4 @@
-class Ability::Author < Ability
+class User::Ability::Author < User::Ability
 
   def initialize(user)
     super
@@ -27,6 +27,12 @@ def initialize(user)
 
   protected
 
+  # Sites sur lesquels l'utilisateur est author. Surchargé en :contributor par
+  # Ability::Contributor, qui hérite des mêmes règles mais sur ses propres sites.
+  def managed_websites_ids
+    @managed_websites_ids ||= scoped_ids(:author)
+  end
+
   def manage_records_based_on_abouts(record_class)
     can :manage, record_class, university_id: @user.university_id, about_type: 'Communication::Website::Agenda::Event::Localization', about_id: managed_agenda_event_localization_ids
     can :manage, record_class, university_id: @user.university_id, about_type: 'Communication::Website::Agenda::Exhibition::Localization', about_id: managed_agenda_exhibition_localization_ids
diff --git a/app/models/ability/contributor.rb b/app/models/user/ability/contributor.rb
similarity index 51%
rename from app/models/ability/contributor.rb
rename to app/models/user/ability/contributor.rb
index 32a29e5f69..9b099ebc9c 100644
--- a/app/models/ability/contributor.rb
+++ b/app/models/user/ability/contributor.rb
@@ -1,4 +1,4 @@
-class Ability::Contributor < Ability::Author
+class User::Ability::Contributor < User::Ability::Author
 
   def initialize(user)
     super
@@ -9,4 +9,12 @@ def initialize(user)
     cannot :publish, Communication::Website::Jobboard::Job
   end
 
+  protected
+
+  # Hérite des règles d'author, mais scopées sur les sites où l'utilisateur est
+  # contributor (l'override est résolu dynamiquement, y compris pendant `super`).
+  def managed_websites_ids
+    @managed_websites_ids ||= scoped_ids(:contributor)
+  end
+
 end
\ No newline at end of file
diff --git a/app/models/ability/program_manager.rb b/app/models/user/ability/program_manager.rb
similarity index 98%
rename from app/models/ability/program_manager.rb
rename to app/models/user/ability/program_manager.rb
index 6af10383d5..2a81db9ddb 100644
--- a/app/models/ability/program_manager.rb
+++ b/app/models/user/ability/program_manager.rb
@@ -1,4 +1,4 @@
-class Ability::ProgramManager < Ability
+class User::Ability::ProgramManager < User::Ability
 
   def initialize(user)
     super
@@ -96,7 +96,7 @@ def managed_post_category_localization_ids
   end
 
   def managed_programs_ids
-    @managed_programs_ids ||= @user.programs_to_manage.pluck(:id)
+    @managed_programs_ids ||= scoped_ids(:program_manager)
   end
 
   def managed_program_localization_ids
diff --git a/app/models/ability/server_admin.rb b/app/models/user/ability/server_admin.rb
similarity index 57%
rename from app/models/ability/server_admin.rb
rename to app/models/user/ability/server_admin.rb
index ba1e7f835a..b6cddfdf95 100644
--- a/app/models/ability/server_admin.rb
+++ b/app/models/user/ability/server_admin.rb
@@ -1,4 +1,4 @@
-class Ability::ServerAdmin < Ability
+class User::Ability::ServerAdmin < User::Ability
 
   def initialize(user)
     super
diff --git a/app/models/ability/teacher.rb b/app/models/user/ability/teacher.rb
similarity index 96%
rename from app/models/ability/teacher.rb
rename to app/models/user/ability/teacher.rb
index 1f95243e66..32b58b5a88 100644
--- a/app/models/ability/teacher.rb
+++ b/app/models/user/ability/teacher.rb
@@ -1,4 +1,4 @@
-class Ability::Teacher < Ability
+class User::Ability::Teacher < User::Ability
 
   def initialize(user)
     super
diff --git a/app/models/ability/website_manager.rb b/app/models/user/ability/website_manager.rb
similarity index 97%
rename from app/models/ability/website_manager.rb
rename to app/models/user/ability/website_manager.rb
index 97012a719a..3e6dafa543 100644
--- a/app/models/ability/website_manager.rb
+++ b/app/models/user/ability/website_manager.rb
@@ -1,4 +1,4 @@
-class Ability::WebsiteManager < Ability
+class User::Ability::WebsiteManager < User::Ability
 
   def initialize(user)
     super
@@ -38,6 +38,11 @@ def initialize(user)
 
   protected
 
+  # Sites dont l'utilisateur est responsable (rôle website_manager).
+  def managed_websites_ids
+    @managed_websites_ids ||= scoped_ids(:website_manager)
+  end
+
   def managed_agenda_category_localization_ids
     @managed_agenda_category_localization_ids ||= begin
       Communication::Website::Agenda::Category::Localization
diff --git a/app/models/user/role.rb b/app/models/user/role.rb
new file mode 100644
index 0000000000..b519353724
--- /dev/null
+++ b/app/models/user/role.rb
@@ -0,0 +1,96 @@
+# == Schema Information
+#
+# Table name: user_roles
+#
+#  id            :uuid             not null, primary key
+#  role          :integer          not null, uniquely indexed => [user_id, scope_type, scope_id]
+#  scope_type    :string           indexed => [scope_id], uniquely indexed => [user_id, role, scope_id]
+#  created_at    :datetime         not null
+#  updated_at    :datetime         not null
+#  scope_id      :uuid             indexed => [scope_type], uniquely indexed => [user_id, role, scope_type]
+#  university_id :uuid             not null, indexed
+#  user_id       :uuid             not null, indexed, uniquely indexed => [role, scope_type, scope_id]
+#
+# Indexes
+#
+#  index_user_roles_on_scope          (scope_type,scope_id)
+#  index_user_roles_on_university_id  (university_id)
+#  index_user_roles_on_user_id        (user_id)
+#  index_user_roles_uniqueness        (user_id,role,scope_type,scope_id) UNIQUE
+#
+# Foreign Keys
+#
+#  fk_rails_318345354e  (user_id => users.id)
+#  fk_rails_c177139056  (university_id => universities.id)
+#
+class User::Role < ApplicationRecord
+
+  # Rôles qui se rattachent à une cible (site ou formation)
+  ROLES_WITH_SCOPE = {
+    'contributor'     => 'Communication::Website',
+    'author'          => 'Communication::Website',
+    'website_manager' => 'Communication::Website',
+    'teacher' => 'Education::Program',
+    'program_manager' => 'Education::Program',
+  }.freeze
+
+  enum :role, {
+    contributor: 4,
+    author: 5,
+    teacher: 10,
+    program_manager: 12,
+    website_manager: 15,
+    alumni_manager: 18,
+    admin: 20,
+  }
+
+  belongs_to :user, inverse_of: :roles
+  belongs_to :university
+  belongs_to :scope, polymorphic: true, optional: true
+
+  before_validation :set_university_from_user
+  validate :scope_required_for_scoped_role
+
+  after_create :autoset_favorite_for_website_manager
+
+  def self.scope_type_for(role_name)
+    ROLES_WITH_SCOPE[role_name]
+  end
+
+  def scope_choice
+    scope_id
+  end
+
+  def scope_choice=(value)
+    self.scope_type = ROLES_WITH_SCOPE[role]
+    self.scope_id = value.presence
+  end
+
+  def to_s
+    [
+      I18n.t("activerecord.attributes.user.roles.#{role}"),
+      scope&.to_s
+    ].compact.join(' — ')
+  end
+
+  protected
+
+  def set_university_from_user
+    self.university ||= user&.university
+  end
+
+  def scope_required_for_scoped_role
+    errors.add(:scope, 'is required for this role') if has_scope? && scope_id.blank?
+  end
+
+  def has_scope?
+    ROLES_WITH_SCOPE[role].present?
+  end
+
+  # Quand on confie un site à un responsable, on l'ajoute à ses favoris pour un
+  # accès rapide (idempotent). Remplace l'ancien autoset_favorites de User.
+  def autoset_favorite_for_website_manager
+    return unless website_manager? && scope.is_a?(Communication::Website)
+    user&.add_favorite(scope)
+  end
+end
diff --git a/app/models/user/with_favorites.rb b/app/models/user/with_favorites.rb
index 66a8cb4636..d5a71a3b24 100644
--- a/app/models/user/with_favorites.rb
+++ b/app/models/user/with_favorites.rb
@@ -3,7 +3,6 @@ module User::WithFavorites
 
   included do
     has_many :favorites, dependent: :destroy
-    after_save :autoset_favorites
   end
 
   def add_favorite(about)
@@ -23,12 +22,4 @@ def favorite?(about)
   def favorites_for(about)
     favorites.where(about_id: about.id, about_type: about.class.polymorphic_name)
   end
-
-  def autoset_favorites
-    if saved_change_to_role? && website_manager? && favorites.none?
-      websites_to_manage.each do |website|
-        add_favorite(website)
-      end
-    end
-  end
 end
diff --git a/app/models/user/with_roles.rb b/app/models/user/with_roles.rb
index b9f80698bf..b2e4ad000d 100644
--- a/app/models/user/with_roles.rb
+++ b/app/models/user/with_roles.rb
@@ -4,6 +4,7 @@ module User::WithRoles
   included do
     attr_accessor :modified_by, :just_autopromoted
 
+    # TODO(multiroles) remove
     enum :role, {
       visitor: 0,
       contributor: 4,
@@ -16,60 +17,92 @@ module User::WithRoles
       server_admin: 30
     }
 
-    has_and_belongs_to_many :programs_to_manage,
-                            class_name: 'Education::Program',
-                            join_table: :education_programs_users,
-                            association_foreign_key: :education_program_id
-
-    has_and_belongs_to_many :websites_to_manage,
-                            class_name: 'Communication::Website',
-                            join_table: :communication_websites_users,
-                            association_foreign_key: :communication_website_id
+    has_many :roles,
+             class_name: 'User::Role',
+             dependent: :destroy,
+             inverse_of: :user
+    accepts_nested_attributes_for :roles, reject_if: :all_blank, allow_destroy: true
 
+    # TODO(multiroles) écrire ça en fonction des rôles liés au user
     scope :for_role, -> (role, language = nil) { where(role: role) }
 
     before_validation :set_default_role, on: :create
-    before_validation :check_modifier_role
+    validate :assigned_roles_within_modifier_scope
+    after_create :bootstrap_role_assignment
     after_create :set_university_autopromote_option, if: :just_autopromoted
 
     def self.roles_with_access_to_global_menu
       roles.keys - ['contributor', 'author', 'website_manager']
     end
 
+    # Rôles effectifs (distincts), ordonnés du moins au plus privilégié.
+    # L'ordre est volontaire : Ability fusionne les abilities dans cet ordre pour
+    # que les règles du rôle le plus puissant soient déclarées en dernier et
+    # l'emportent (CanCanCan évalue de la dernière règle définie à la première).
+    def ability_roles
+      roles.map(&:role).uniq.sort_by { |name| self.class.roles[name] }
+    end
+
+    # Détient ce rôle (sur n'importe quelle cible) ?
+    def has_role?(name)
+      roles.any? { |user_role| user_role.role == name.to_s }
+    end
+
+    # Cibles (records) attachées à un rôle donné.
+    def scopes_for(role_name)
+      roles.select { |user_role| user_role.role == role_name.to_s }
+           .filter_map(&:scope)
+    end
+
+    def grant_role!(role_name, scope: nil)
+      roles.find_or_create_by!(
+        role: role_name,
+        scope_type: scope&.class&.base_class&.name,
+        scope_id: scope&.id
+      )
+    end
+
     def managed_roles
-      User.roles.map do |role_name, role_id|
-        next if role_id > User.roles[role]
-        role_name
-      end.compact
+      can_grant_roles? ? User::Role.roles.keys : []
+    end
+
+    def can_grant_roles?
+      server_admin? || has_role?('admin')
     end
 
     def managed_websites
-      if server_admin?
+      if has_role?('server_admin')
         Communication::Website.all
-      elsif admin?
+      elsif has_role?('admin')
         Communication::Website.where(university_id: university_id)
-      elsif website_manager?
-        Communication::Website.where(id: websites_to_manage_ids)
+      elsif has_role?('website_manager')
+        Communication::Website.where(id: scopes_for('website_manager').map(&:id))
       else
         Communication::Website.none
       end
     end
 
     def can_display_global_menu?
-      User.roles_with_access_to_global_menu.include?(role)
+      (ability_roles & User.roles_with_access_to_global_menu).any?
     end
 
     protected
 
-    def check_modifier_role
-      errors.add(:role, 'cannot be set to this role') if modified_by && !modified_by.managed_roles.include?(self.role)
+    # Empêche d'attribuer un rôle au-dessus de ce que le modificateur gère.
+    def assigned_roles_within_modifier_scope
+      return unless modified_by
+      assigned = roles.reject(&:marked_for_destruction?).map(&:role).uniq
+      forbidden = assigned - modified_by.managed_roles
+      errors.add(:base, 'cannot assign a role above your own') if forbidden.any?
     end
 
     def set_default_role
       return if server_admin?
       if User.all.empty?
+        # Premier user de toutes les instances
         self.role = :server_admin
       elsif !university.admin_already_auto_promoted? && university.users.not_server_admin.empty?
+        # Premier user de l'instsance
         self.role = :admin
         self.just_autopromoted = true
       end
diff --git a/app/models/user/with_sync_between_universities.rb b/app/models/user/with_sync_between_universities.rb
index 11aa0aae80..af6dc98829 100644
--- a/app/models/user/with_sync_between_universities.rb
+++ b/app/models/user/with_sync_between_universities.rb
@@ -24,13 +24,16 @@ def sync_in_university(target_university)
     unless User.where(email: email, university_id: target_university.id).any?
       duplicate_user_for_university(target_university)
     else
-      User.find_by(email: email, university_id: target_university.id)&.update_columns(
+      existing = User.find_by(email: email, university_id: target_university.id)
+      existing&.update_columns(
         encrypted_password: self.encrypted_password,
         first_name: self.first_name,
         last_name: self.last_name,
         mobile_phone: self.mobile_phone,
         role: :server_admin
       )
+      # `role` est un cache ; la source de vérité est roles.
+      existing&.grant_role!(:server_admin)
     end
   end
 
diff --git a/app/views/admin/education/programs/parts/admission.html.erb b/app/views/admin/education/programs/parts/admission.html.erb
index c727dbd69e..e61916c4c8 100644
--- a/app/views/admin/education/programs/parts/admission.html.erb
+++ b/app/views/admin/education/programs/parts/admission.html.erb
@@ -36,11 +36,9 @@
 
 <%
 action = ''
-if !current_user.program_manager? || current_user.programs_to_manage.pluck(:education_program_id).include?(@program.id)
 action += link_to t('education.manage_roles'),
                   admin_education_program_roles_path(program_id: @program.id),
-                  class: 'action' if can?(:update, University::Role)
-end
+                  class: 'action' if can?(:edit, @program)
 %>
 <%= osuny_panel Education::Program.human_attribute_name('roles'), action: action, classes: 'mt-5' do %>
   <% if @roles.any? %>
diff --git a/app/views/admin/users/_form.html.erb b/app/views/admin/users/_form.html.erb
index ee3da5ac0f..b9e232793b 100644
--- a/app/views/admin/users/_form.html.erb
+++ b/app/views/admin/users/_form.html.erb
@@ -3,27 +3,33 @@
   <%= f.error_notification message: f.object.errors[:base].to_sentence if f.object.errors[:base].present? %>
 
   <div class="row">
-    <div class="col-lg-4">
+    <div class="col-lg-3">
       <%= f.input :email %>
       <%= f.input :first_name %>
       <%= f.input :last_name %>
+      <%= f.input :mobile_phone %>
       <%= render 'admin/application/l10n/form', f: f %>
     </div>
-    <div class="col-lg-4">
-      <%= f.input :mobile_phone %>
-      <%= f.input :role, include_blank: false, collection: current_user.managed_roles, label_method: lambda { |k| t("activerecord.attributes.user.roles.#{k[1]}")} %>
-      <div data-show-for-roles="program_manager">
-        <%= f.association :programs_to_manage,
-                          as: :check_boxes,
-                          collection: osuny_collection_tree(current_university.education_programs.root, localized: true) %>
-      </div>
-      <div data-show-for-roles="author,contributor,website_manager">
-        <%= f.association :websites_to_manage,
-                          as: :check_boxes,
-                          collection: osuny_collection(current_university.communication_websites, localized: true) %>
-      </div>
+    <div class="col-lg-6">
+      <%= osuny_label User.human_attribute_name('roles') %>
+      <% if user.server_admin? %>
+        <%= f.input :server_admin %>
+      <% else %>
+        <p class="text-muted small mb-2"><%= t('admin.users.roles_hint') %></p>
+        <div id="user_roles">
+          <%= f.simple_fields_for :roles do |role_f| %>
+            <%= render 'admin/users/role_fields', f: role_f %>
+          <% end %>
+        </div>
+        <%= link_to_add_association t('admin.users.add_role'), f, :roles,
+              class: button_classes,
+              data: {
+                'association-insertion-method': 'append',
+                'association-insertion-node':   '#user_roles'
+              } %>
+      <% end %>
     </div>
-    <div class="col-lg-4">
+    <div class="col-lg-3">
       <%= f.input :picture,
               as: :single_deletable_file,
               input_html: { accept: default_images_formats_accepted },
diff --git a/app/views/admin/users/_role_fields.html.erb b/app/views/admin/users/_role_fields.html.erb
new file mode 100644
index 0000000000..e89255856b
--- /dev/null
+++ b/app/views/admin/users/_role_fields.html.erb
@@ -0,0 +1,41 @@
+<%
+# Chaque <option> porte son type de cible via data-scope-type. C'est l'unique
+# source pour le JS : une option de rôle annonce le type qu'elle attend (rien si
+# rôle global), une option de cible annonce son type ; le JS n'affiche que les
+# cibles du même type. (Côté soumission, seul l'uuid part : le type est redéduit
+# du rôle dans User::Role.)
+role_options = safe_join(
+  current_user.managed_roles.map { |role_name|
+    content_tag(:option, t("activerecord.attributes.user/role.roles.#{role_name}"),
+                value: role_name, selected: role_name == f.object.role,
+                data: { 'scope-type': User::Role.scope_type_for(role_name) })
+  }
+)
+scope_options = safe_join(
+  osuny_collection(current_university.communication_websites, localized: true).map { |label, id|
+    content_tag(:option, label, value: id, selected: id == f.object.scope_id,
+                data: { 'scope-type': 'Communication::Website' })
+  } +
+  osuny_collection_tree(current_university.education_programs.root, localized: true).map { |label, id|
+    content_tag(:option, label, value: id, selected: id == f.object.scope_id,
+                data: { 'scope-type': 'Education::Program' })
+  }
+)
+%>
+<%# .nested-fields ne doit PAS porter d-flex : cocoon le masque en display:none %>
+<%# (inline), que `.d-flex { display:flex !important }` écraserait. Le flex est %>
+<%# donc sur un wrapper interne. %>
+<div class="nested-fields user-role-fields mb-2" data-user-role>
+  <div class="row g-2 align-items-start">
+    <div class="col">
+      <%= f.select :role, role_options, {}, class: 'form-select', data: { 'user-role-role': '' } %>
+    </div>
+    <div class="col" data-user-role-scope-container>
+      <%= f.select :scope_choice, scope_options, {},
+                   class: 'form-select', data: { 'user-role-scope': '' } %>
+    </div>
+    <div class="col-auto">
+      <%= link_to_remove_association "<i class=\"#{Icon::DELETE}\"></i>".html_safe, f, class: 'btn btn-sm text-danger' %>
+    </div>
+  </div>
+</div>
diff --git a/app/views/admin/users/show.html.erb b/app/views/admin/users/show.html.erb
index 9ab0203882..96a4a7a3f4 100644
--- a/app/views/admin/users/show.html.erb
+++ b/app/views/admin/users/show.html.erb
@@ -10,37 +10,37 @@
 <%= render 'lock' %>
 
 <div class="row">
-  <div class="col-lg-4">
+  <div class="col-lg-3">
     <%= osuny_label User.human_attribute_name('email') %>
     <p><%= link_to @user.email, "mailto:#{@user.email}" %></p>
     <%= osuny_label User.human_attribute_name('first_name') %>
     <p><%= @user.first_name %></p>
     <%= osuny_label User.human_attribute_name('last_name') %>
     <p><%= @user.last_name %></p>
+    <%= osuny_label User.human_attribute_name('mobile_phone') %>
+    <p><%= @user.mobile_phone %></p>
     <%= osuny_label User.human_attribute_name('language') %>
     <p><%= language_name(@user.language.iso_code) %></p>
   </div>
-  <div class="col-lg-4">
-    <%= osuny_label User.human_attribute_name('mobile_phone') %>
-    <p><%= @user.mobile_phone %></p>
-    <%= osuny_label User.human_attribute_name('role') %>
-    <p><%= t("activerecord.attributes.user.roles.#{@user.role.to_s}") %></p>
-    <% if @user.websites_to_manage.any? %>
-      <%= osuny_label User.human_attribute_name('websites_to_manage') %>
-      <ul class="list-unstyled">
-        <% @user.websites_to_manage.each do |website| %>
-          <li><%= website %></li>
-        <% end %>
-      </ul>
+  <div class="col-lg-6">
+    <%= osuny_label User.human_attribute_name('roles') %>
+    <% if @user.server_admin? %>
+      <p><%= t("activerecord.attributes.user.server_admin") %></p>
+    <% else %>
+      <% if @user.roles.any? %>
+        <ul class="list-unstyled">
+          <% @user.roles.includes(:scope).each do |user_role| %>
+            <li>
+              <%= t("activerecord.attributes.user/role.roles.#{user_role.role}") %><%
+                if user_role.scope %> — <%= user_role.scope.try(:to_s_in, current_language) || user_role.scope %><% end %>
+            </li>
+          <% end %>
+        </ul>
+      <% else %>
+        <p><%= t("activerecord.attributes.user.roles.#{@user.role}") %></p>
+      <% end %>
     <% end %>
-    <% if @user.programs_to_manage.any? %>
-      <%= osuny_label User.human_attribute_name('programs_to_manage') %>
-      <ul class="list-unstyled">
-        <% @user.programs_to_manage.each do |program| %>
-          <li><%= program.to_s_in(current_language) %></li>
-        <% end %>
-      </ul>
-    <% end %>    <% if @user.person %>
+    <% if @user.person %>
       <%= osuny_label User.human_attribute_name('person') %>
       <p><%= osuny_link_localized @user.person, [:admin, @user.person] %></p>
     <% end %>
@@ -50,7 +50,7 @@
     <% end %>
   </div>
   <% if @user.picture.attached? %>
-    <div class="col-lg-4">
+    <div class="col-lg-3">
       <%= osuny_label t('activerecord.attributes.user.picture') %>
       <%= kamifusen_tag @user.picture, class: 'img-fluid' %>
     </div>
diff --git a/app/views/extranet/account/edit.html.erb b/app/views/extranet/account/edit.html.erb
index e6e53a273f..7bea6dce81 100644
--- a/app/views/extranet/account/edit.html.erb
+++ b/app/views/extranet/account/edit.html.erb
@@ -59,7 +59,7 @@
 
   <%= submit f %>
 
-  <% if current_user.visitor? %>
+  <% if current_user.roles.none? %>
     <%# we don't want the osuny priviledged account to be able to get deleted through extranet %>
     <h3 class="mt-5 mb-4"><%= t("devise.registrations.edit.cancel_my_account") %></h3>
 
diff --git a/app/views/server/universities/index.html.erb b/app/views/server/universities/index.html.erb
index 4941067c55..8b5f7c8aea 100644
--- a/app/views/server/universities/index.html.erb
+++ b/app/views/server/universities/index.html.erb
@@ -32,12 +32,12 @@
         <tr>
           <td><%= link_to university, [:server, university] %></td>
           <td><%= link_to university.url, university.url, target: :_blank %></td>
-          <td>
-            <%= university.private ? University.human_attribute_name('private') :
-                                     University.human_attribute_name('public') %>
-          </td>
+          <td><%= university.private ?  University.human_attribute_name('private') :
+                                        University.human_attribute_name('public') %></td>
           <td><%= university.languages.count %></td>
-          <td><%= link_to university.users.not_server_admin.count, "#{university.url}/admin/users", target: :_blank %></td>
+          <td><%= link_to university.users.not_server_admin.count,
+                          "#{university.url}/admin/users",
+                          target: :_blank %></td>
           <% if university.contribution_amount.to_i.zero? %>
             <td></td>
             <td></td>
diff --git a/app/views/server/universities/show.html.erb b/app/views/server/universities/show.html.erb
index 6d2cee3cab..ad86650fa2 100644
--- a/app/views/server/universities/show.html.erb
+++ b/app/views/server/universities/show.html.erb
@@ -21,7 +21,9 @@
         </tr>
         <tr>
           <td><%= t('server_admin.universities.users_count') %></td>
-          <td class="text-end"><%= link_to @university.users.not_server_admin.count, "#{@university.url}/admin/users", target: :_blank %></td>
+          <td class="text-end"><%= link_to  @university.users.not_server_admin.count, 
+                                            "#{@university.url}/admin/users",
+                                            target: :_blank %></td>
         </tr>
 
         <% unless @university.contribution_amount.to_i.zero? %>
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 9b89adae69..dffa8a1470 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -226,6 +226,9 @@ en:
       done: Translation done! Please proof read before you save.
       running: Currently translating
       unavailable_button: Automatic translation unavailable
+    users:
+      add_role: Add a role
+      roles_hint: A user can hold several roles, each optionally limited to one website or program.
     users_alerts:
       already_confirmed: "Your account has already been confirmed."
       not_locked_html: '<i>%{model}</i> was not locked.'
diff --git a/config/locales/fr.yml b/config/locales/fr.yml
index 5d6d02f4aa..43853009d3 100644
--- a/config/locales/fr.yml
+++ b/config/locales/fr.yml
@@ -76,6 +76,11 @@ fr:
         picture: Photo de profil
         picture_url: Url de la photo de profil
         programs_to_manage: Formation(s) gérée(s)
+        roles: Rôles
+        server_admin: Administrateurice du serveur
+        university: Université
+        websites_to_manage: Sites gérés
+      user/role:
         role: Rôle
         roles:
           admin: Administrateur
@@ -83,12 +88,9 @@ fr:
           author: Auteur
           contributor: Contributeur
           program_manager: Responsable de formation
-          server_admin: Administrateur du serveur
           teacher: Enseignant·e
           visitor: Visiteur
           website_manager: Responsable de site web
-        university: Université
-        websites_to_manage: Sites gérés
     errors:
       messages:
         invalid_year: L'année doit être un nombre à 4 chiffres.
@@ -226,6 +228,9 @@ fr:
       done: Traduction effectuée ! Merci de relire avant d'enregistrer.
       running: Traduction en cours
       unavailable_button: Traduction automatique indisponible
+    users:
+      add_role: Ajouter un rôle
+      roles_hint: Un utilisateur peut cumuler plusieurs rôles, chacun pouvant être limité à un site ou une formation.
     users_alerts:
       already_confirmed: "Votre compte est déjà confirmé."
       not_locked_html: "<i>%{model}</i> n'était pas verrouillé(e)."
diff --git a/db/migrate/20260623120000_create_user_roles.rb b/db/migrate/20260623120000_create_user_roles.rb
new file mode 100644
index 0000000000..5ad1adafd1
--- /dev/null
+++ b/db/migrate/20260623120000_create_user_roles.rb
@@ -0,0 +1,60 @@
+class CreateUserRoles < ActiveRecord::Migration[8.1]
+  def up
+    create_table :user_roles, id: :uuid do |t|
+      t.references :user, type: :uuid, null: false, foreign_key: true
+      t.references :university, type: :uuid, null: false, foreign_key: true
+      t.integer :role, null: false
+      t.references :scope, type: :uuid, polymorphic: true, null: true
+      t.timestamps
+    end
+    add_index :user_roles,
+              [:user_id, :role, :scope_type, :scope_id],
+              unique: true,
+              name: "index_user_roles_uniqueness"
+
+    backfill_from_existing_roles
+  end
+
+  def down
+    drop_table :user_roles
+  end
+
+  private
+
+  # Encodage de l'enum User::ROLES (cf. User::Role) :
+  #   contributor 4, author 5, website_manager 15  -> scopés sur des sites
+  #   program_manager 12                            -> scopé sur des formations
+  #   teacher 10, admin 20, server_admin 30         -> globaux (sans scope)
+  #   visitor 0                                     -> pas de ligne (aucun droit)
+  def backfill_from_existing_roles
+    # Rôles globaux : une ligne sans scope
+    execute <<~SQL
+      INSERT INTO user_roles (id, user_id, university_id, role, created_at, updated_at)
+      SELECT public.gen_random_uuid(), u.id, u.university_id, u.role, now(), now()
+      FROM users u
+      WHERE u.role IN (10, 20, 30)
+    SQL
+
+    # Rôles scopés sur des sites : une ligne par site géré
+    execute <<~SQL
+      INSERT INTO user_roles (id, user_id, university_id, role, scope_type, scope_id, created_at, updated_at)
+      SELECT public.gen_random_uuid(), u.id, u.university_id, u.role,
+             'Communication::Website', cwu.communication_website_id, now(), now()
+      FROM users u
+      JOIN communication_websites_users cwu ON cwu.user_id = u.id
+      WHERE u.role IN (4, 5, 15)
+    SQL
+
+    # Rôle scopé sur des formations : une ligne par formation gérée
+    execute <<~SQL
+      INSERT INTO user_roles (id, user_id, university_id, role, scope_type, scope_id, created_at, updated_at)
+      SELECT public.gen_random_uuid(), u.id, u.university_id, u.role,
+             'Education::Program', epu.education_program_id, now(), now()
+      FROM users u
+      JOIN education_programs_users epu ON epu.user_id = u.id
+      WHERE u.role = 12
+    SQL
+    # Un rôle scopé sans aucune cible n'accordait déjà aucun droit : on ne crée
+    # pas de ligne pour ces utilisateurs (ils deviennent de fait visiteurs).
+  end
+end
diff --git a/db/migrate/20260707071953_add_server_admin_to_users.rb b/db/migrate/20260707071953_add_server_admin_to_users.rb
new file mode 100644
index 0000000000..3352489e2b
--- /dev/null
+++ b/db/migrate/20260707071953_add_server_admin_to_users.rb
@@ -0,0 +1,6 @@
+class AddServerAdminToUsers < ActiveRecord::Migration[8.1]
+  def change
+    add_column :users, :server_admin, :boolean, default: false
+    User.where(role: 30).update_all(server_admin: true)
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index d5c3a601fb..b837b5edad 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.1].define(version: 2026_07_02_133651) do
+ActiveRecord::Schema[8.1].define(version: 2026_07_07_071953) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "pg_catalog.plpgsql"
   enable_extension "pg_stat_statements"
@@ -439,6 +439,86 @@
     t.index ["university_id"], name: "index_communication_extranets_on_university_id"
   end
 
+  create_table "communication_file_categories", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.string "bodyclass"
+    t.datetime "created_at", null: false
+    t.boolean "is_taxonomy", default: false
+    t.uuid "parent_id"
+    t.integer "position", default: 0
+    t.integer "position_in_tree"
+    t.uuid "university_id", null: false
+    t.datetime "updated_at", null: false
+    t.index ["parent_id"], name: "index_communication_file_categories_on_parent_id"
+    t.index ["university_id"], name: "index_communication_file_categories_on_university_id"
+  end
+
+  create_table "communication_file_categories_files", id: false, force: :cascade do |t|
+    t.uuid "category_id", null: false
+    t.uuid "file_id", null: false
+    t.index ["category_id"], name: "index_communication_file_categories_files_on_category_id"
+    t.index ["file_id", "category_id"], name: "file_category"
+    t.index ["file_id"], name: "index_communication_file_categories_files_on_file_id"
+  end
+
+  create_table "communication_file_category_localizations", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.uuid "about_id"
+    t.datetime "created_at", null: false
+    t.text "featured_image_alt"
+    t.text "featured_image_credit"
+    t.uuid "language_id"
+    t.text "meta_description"
+    t.string "name"
+    t.string "slug"
+    t.text "summary"
+    t.uuid "university_id"
+    t.datetime "updated_at", null: false
+    t.index ["about_id", "language_id"], name: "idx_on_about_id_language_id_f3d63b2051", unique: true
+    t.index ["about_id"], name: "index_communication_file_category_localizations_on_about_id"
+    t.index ["language_id"], name: "index_communication_file_category_localizations_on_language_id"
+    t.index ["university_id"], name: "idx_on_university_id_7bebff08b4"
+  end
+
+  create_table "communication_file_contexts", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.uuid "about_id"
+    t.string "about_type"
+    t.uuid "communication_file_localization_id", null: false
+    t.datetime "created_at", null: false
+    t.uuid "university_id", null: false
+    t.datetime "updated_at", null: false
+    t.index ["about_type", "about_id"], name: "index_communication_file_contexts_on_about"
+    t.index ["communication_file_localization_id"], name: "idx_on_communication_file_localization_id_a9a8fdc48e"
+    t.index ["university_id"], name: "index_communication_file_contexts_on_university_id"
+  end
+
+  create_table "communication_file_localizations", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.uuid "about_id", null: false
+    t.datetime "created_at", null: false
+    t.text "internal_description"
+    t.uuid "language_id", null: false
+    t.string "name"
+    t.uuid "original_blob_id", null: false
+    t.bigint "original_byte_size"
+    t.string "original_checksum"
+    t.string "original_content_type"
+    t.string "original_filename"
+    t.string "slug"
+    t.uuid "university_id", null: false
+    t.datetime "updated_at", null: false
+    t.index ["about_id"], name: "index_communication_file_localizations_on_about_id"
+    t.index ["language_id"], name: "index_communication_file_localizations_on_language_id"
+    t.index ["original_blob_id"], name: "index_communication_file_localizations_on_original_blob_id"
+    t.index ["university_id"], name: "index_communication_file_localizations_on_university_id"
+  end
+
+  create_table "communication_files", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.datetime "created_at", null: false
+    t.uuid "created_by_id"
+    t.uuid "university_id", null: false
+    t.datetime "updated_at", null: false
+    t.index ["created_by_id"], name: "index_communication_files_on_created_by_id"
+    t.index ["university_id"], name: "index_communication_files_on_university_id"
+  end
+
   create_table "communication_media_categories", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
     t.string "bodyclass"
     t.datetime "created_at", null: false
@@ -2520,6 +2600,20 @@
     t.index ["user_id"], name: "index_user_favorites_on_user_id"
   end
 
+  create_table "user_roles", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+    t.datetime "created_at", null: false
+    t.integer "role", null: false
+    t.uuid "scope_id"
+    t.string "scope_type"
+    t.uuid "university_id", null: false
+    t.datetime "updated_at", null: false
+    t.uuid "user_id", null: false
+    t.index ["scope_type", "scope_id"], name: "index_user_roles_on_scope"
+    t.index ["university_id"], name: "index_user_roles_on_university_id"
+    t.index ["user_id", "role", "scope_type", "scope_id"], name: "index_user_roles_uniqueness", unique: true
+    t.index ["user_id"], name: "index_user_roles_on_user_id"
+  end
+
   create_table "users", id: :uuid, default: -> { "public.gen_random_uuid()" }, force: :cascade do |t|
     t.integer "brevo_contact_id"
     t.datetime "confirmation_sent_at", precision: nil
@@ -2551,6 +2645,7 @@
     t.string "reset_password_token"
     t.integer "role", default: 0
     t.integer "second_factor_attempts_count", default: 0
+    t.boolean "server_admin", default: false
     t.string "session_token"
     t.integer "sign_in_count", default: 0, null: false
     t.datetime "totp_timestamp", precision: nil
@@ -2628,6 +2723,21 @@
   add_foreign_key "communication_extranet_posts", "university_people", column: "author_id"
   add_foreign_key "communication_extranets", "languages", column: "default_language_id"
   add_foreign_key "communication_extranets", "universities"
+  add_foreign_key "communication_file_categories", "communication_file_categories", column: "parent_id"
+  add_foreign_key "communication_file_categories", "universities"
+  add_foreign_key "communication_file_categories_files", "communication_file_categories", column: "category_id"
+  add_foreign_key "communication_file_categories_files", "communication_files", column: "file_id"
+  add_foreign_key "communication_file_category_localizations", "communication_file_categories", column: "about_id"
+  add_foreign_key "communication_file_category_localizations", "languages"
+  add_foreign_key "communication_file_category_localizations", "universities"
+  add_foreign_key "communication_file_contexts", "communication_file_localizations"
+  add_foreign_key "communication_file_contexts", "universities"
+  add_foreign_key "communication_file_localizations", "active_storage_blobs", column: "original_blob_id"
+  add_foreign_key "communication_file_localizations", "communication_files", column: "about_id"
+  add_foreign_key "communication_file_localizations", "languages"
+  add_foreign_key "communication_file_localizations", "universities"
+  add_foreign_key "communication_files", "universities"
+  add_foreign_key "communication_files", "users", column: "created_by_id"
   add_foreign_key "communication_media_categories", "communication_media_categories", column: "parent_id"
   add_foreign_key "communication_media_categories", "universities"
   add_foreign_key "communication_media_category_localizations", "communication_media_categories", column: "about_id"
@@ -2903,6 +3013,8 @@
   add_foreign_key "university_role_localizations", "university_roles", column: "about_id"
   add_foreign_key "university_roles", "universities"
   add_foreign_key "user_favorites", "users"
+  add_foreign_key "user_roles", "universities"
+  add_foreign_key "user_roles", "users"
   add_foreign_key "users", "languages"
   add_foreign_key "users", "universities"
 end
diff --git a/test/controllers/admin/users_controller_test.rb b/test/controllers/admin/users_controller_test.rb
new file mode 100644
index 0000000000..33cc17cf72
--- /dev/null
+++ b/test/controllers/admin/users_controller_test.rb
@@ -0,0 +1,71 @@
+require "test_helper"
+
+# rails test test/controllers/admin/users_controller_test.rb
+class Admin::UsersControllerTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in_with_2fa(admin)
+  end
+
+  test "edit affiche le formulaire multi-rôles" do
+    get edit_admin_user_path(alumnus, lang: french)
+
+    assert_response :success
+    assert_includes response.body, 'id="user_roles"'
+    assert_includes response.body, "Ajouter un rôle"
+  end
+
+  test "edit présélectionne les rôles existants et leur cible, sans visitor" do
+    target = User.find(alumnus.id)
+    target.grant_role!(:website_manager, scope: website_with_github)
+
+    get edit_admin_user_path(target, lang: french)
+    assert_response :success
+
+    role_select = response.body[/<select[^>]*data-user-role-role[^>]*>.*?<\/select>/m]
+    assert_match(/value="website_manager"[^>]*selected="selected"|selected="selected"[^>]*value="website_manager"/, role_select)
+    # Le rôle visitor (sans droit) n'est jamais proposé.
+    assert_not_includes role_select, 'value="visitor"'
+
+    # La cible est transmise par son seul uuid, présélectionnée.
+    scope_select = response.body[/<select[^>]*data-user-role-scope[^>]*>.*?<\/select>/m]
+    assert_match(/value="#{website_with_github.id}"[^>]*selected="selected"|selected="selected"[^>]*value="#{website_with_github.id}"/, scope_select)
+
+    # .nested-fields ne doit pas porter d-flex, sinon cocoon ne peut pas la
+    # masquer (display:none écrasé par flex !important) — pas de feedback visuel.
+    nested_fields_class = response.body[/class="(nested-fields[^"]*)"/, 1]
+    assert_not_includes nested_fields_class, "d-flex"
+  end
+
+  test "attribue des rôles scopés via les attributs imbriqués" do
+    patch admin_user_path(alumnus, lang: french), params: {
+      user: {
+        roles_attributes: {
+          "0" => { role: "website_manager", scope_choice: website_with_github.id }
+        }
+      }
+    }
+
+    target = User.find(alumnus.id)
+    assert_equal ["website_manager"], target.roles.pluck(:role)
+    assert_equal website_with_github, target.roles.first.scope
+    assert_equal "website_manager", target.role
+  end
+
+  test "supprime un rôle via _destroy (lien de suppression cocoon)" do
+    target = User.find(alumnus.id)
+    role = target.grant_role!(:website_manager, scope: website_with_github)
+
+    # La ligne masquée par cocoon resoumet rôle + cible en plus de _destroy.
+    patch admin_user_path(target, lang: french), params: {
+      user: {
+        roles_attributes: {
+          "0" => { id: role.id, role: "website_manager", scope_choice: website_with_github.id, _destroy: "1" }
+        }
+      }
+    }
+
+    target.reload
+    assert_empty target.roles
+    assert_equal "visitor", target.role # le cache retombe sur visitor
+  end
+end
diff --git a/test/fixtures/user/roles.yml b/test/fixtures/user/roles.yml
new file mode 100644
index 0000000000..6f519053a6
--- /dev/null
+++ b/test/fixtures/user/roles.yml
@@ -0,0 +1,5 @@
+admin:
+  user: admin
+  university: default_university
+  role: admin
+
diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml
index 51118b03b0..a7c843edca 100644
--- a/test/fixtures/users.yml
+++ b/test/fixtures/users.yml
@@ -3,7 +3,6 @@ alumnus:
   email: alumnus@osuny.org
   first_name: Alumnus
   last_name: Osuny
-  role: visitor
   language: fr
   university: default_university
 
@@ -12,7 +11,6 @@ admin:
   email: admin@osuny.org
   first_name: Admin
   last_name: Osuny
-  role: admin
   language: fr
   university: default_university
 
@@ -21,6 +19,6 @@ server_admin:
   email: serveradmin@osuny.org
   first_name: Server Admin
   last_name: Osuny
-  role: server_admin
   language: fr
+  server_admin: true
   university: default_university
diff --git a/test/models/user/ability_test.rb b/test/models/user/ability_test.rb
new file mode 100644
index 0000000000..37d61fbb3c
--- /dev/null
+++ b/test/models/user/ability_test.rb
@@ -0,0 +1,68 @@
+require "test_helper"
+
+# rails test test/models/user/ability_test.rb
+class User::AbilityTest < ActiveSupport::TestCase
+  def program
+    @program ||= education_programs(:default_program)
+  end
+
+  # Construit en mémoire (sans persister) les rôles d'un utilisateur, pour
+  # tester Ability sans effet de bord (pas de callbacks, pas d'API externe).
+  def user_with(fixture, *roles)
+    user = User.find(users(fixture).id)
+    user.roles.load_target # charge les éventuels rôles fixtures
+    roles.each do |attrs|
+      user.roles.build(university: default_university, **attrs)
+    end
+    user
+  end
+
+  def event_on(website)
+    Communication::Website::Agenda::Event.new(
+      university_id: default_university.id,
+      communication_website_id: website.id
+    )
+  end
+
+  test "un seul rôle : admin gère son université mais ne détruit pas de site" do
+    ability = User::Ability.for(admin)
+    assert ability.can?(:manage, University::Organization.new(university_id: default_university.id))
+    assert_not ability.can?(:destroy, Communication::Website.new(university_id: default_university.id))
+  end
+
+  test "visitor (aucun rôle) : aucun droit" do
+    ability = User::Ability.for(alumnus)
+    assert_not ability.can?(:manage, Communication::Website.new(university_id: default_university.id))
+  end
+
+  test "un author n'a de droits que sur SES sites" do
+    user = user_with(:alumnus, { role: :author, scope: website_with_github })
+    ability = User::Ability.for(user)
+    assert ability.can?(:create, event_on(website_with_github))
+    assert_not ability.can?(:create, event_on(website_with_gitlab))
+  end
+
+  test "les rôles sont additifs : chacun apporte ses droits" do
+    author_only = User::Ability.for(user_with(:alumnus, { role: :author, scope: website_with_github }))
+    author_and_pm = User::Ability.for(user_with(:alumnus,
+                                          { role: :author, scope: website_with_github },
+                                          { role: :program_manager, scope: program }))
+    category = Education::Program::Category.new(university_id: default_university.id)
+
+    assert_not author_only.can?(:manage, category)
+    assert author_and_pm.can?(:manage, category)
+  end
+
+  test "les rôles fusionnent du moins au plus privilégié" do
+    user = user_with(:server_admin, { role: :website_manager, scope: website_with_github })
+    assert_equal ["website_manager", "server_admin"], user.ability_roles
+  end
+
+  test "le rôle le plus puissant l'emporte sur un cannot plus restrictif" do
+    # server_admin (can :manage, :all) + website_manager (cannot :destroy site) :
+    # l'ordre de fusion doit préserver le droit de destruction du server_admin.
+    user = user_with(:server_admin, { role: :website_manager, scope: website_with_github })
+    website = Communication::Website.new(university_id: default_university.id)
+    assert User::Ability.for(user).can?(:destroy, website)
+  end
+end
diff --git a/test/models/user/role_test.rb b/test/models/user/role_test.rb
new file mode 100644
index 0000000000..d5ac41270b
--- /dev/null
+++ b/test/models/user/role_test.rb
@@ -0,0 +1,77 @@
+require "test_helper"
+
+# rails test test/models/user/role_test.rb
+class User::RoleTest < ActiveSupport::TestCase
+  def site_a
+    @site_a ||= website_with_github
+  end
+
+  def program
+    @program ||= education_programs(:default_program)
+  end
+
+  # alumnus est un visitor sans rôle au départ.
+  def user
+    @user ||= User.find(alumnus.id)
+  end
+
+  test "les attributs imbriqués créent des rôles scopés et rafraîchissent le cache" do
+    user.modified_by = admin
+    user.update!(roles_attributes: [
+      { role: "website_manager", scope_choice: site_a.id },
+      { role: "admin" }
+    ])
+    user.reload
+
+    assert_equal %w[admin website_manager], user.roles.pluck(:role).sort
+    website_manager_role = user.roles.find_by(role: "website_manager")
+    assert_equal site_a, website_manager_role.scope
+    assert_equal user.university, website_manager_role.university
+    # cache = rôle le plus élevé détenu
+    assert_equal "admin", user.role
+  end
+
+  test "ne transmet que l'uuid ; le type de cible est déduit du rôle" do
+    role = user.roles.build(role: "program_manager")
+    role.scope_choice = program.id
+    role.valid? # déclenche la déduction du type depuis le rôle
+    assert_equal "Education::Program", role.scope_type
+    assert_equal program, role.scope
+    assert_equal program.id, role.scope_choice
+  end
+
+  test "refuse un rôle au-dessus de ce que le modificateur gère" do
+    user.modified_by = admin # un admin ne gère pas server_admin
+    user.roles_attributes = [{ role: "server_admin" }]
+
+    assert_not user.save
+    assert user.errors[:base].present?
+  end
+
+  test "efface la cible d'un rôle global" do
+    role = user.roles.build(role: "admin", scope: site_a)
+    assert role.valid?
+    assert_nil role.scope
+  end
+
+  test "exige une cible pour un rôle scopé" do
+    role = user.roles.build(role: "website_manager")
+    assert_not role.valid?
+  end
+
+  test "force le type de cible selon le rôle (pas de mauvais type possible)" do
+    role = user.roles.build(role: "website_manager", scope_id: program.id)
+    role.valid?
+    assert_equal "Communication::Website", role.scope_type
+  end
+
+  test "grant_role! est idempotent et maintient le cache" do
+    user.grant_role!(:website_manager, scope: site_a)
+    user.grant_role!(:website_manager, scope: site_a) # idempotent
+    user.reload
+
+    assert_equal 1, user.roles.where(role: "website_manager").count
+    assert user.has_role?("website_manager")
+    assert_equal "website_manager", user.role
+  end
+end