I operate a website for a facility that hosts a public resource for researchers. You can think of it as a shared computing facility.

The website hosts several web-based tools that allows users to interact with and use the resources. Some of these tools are only available to users if they authorize the website to act "as" the user on the compute resources (i.e., the web tool to run command X can only work by having the website process log in to the system as 'user@system' and then run command X).

This involves making a one-time change to the user's account (which is a single account for both the website and the computing facility). It's a serious account change with security implications, so it's important that users understand how to undo it if they every want to.

On visiting the page for these tools, the user will see a message like the following:

If they click "Cancel" they won't be able to use the tool. If they click "Authorize", the necessary change is made to the user's account, and they can use the tool. On future visit to that page, they won't see the message again.

If a user wants to undo this change, they can do that from their user profile page on the website. But since that isn't where they authorized that change in the first place, it may not be obvious to users that they need to go there to undo the change.

The other option I can think of is to remind users that they can undo that change at the top of the page where they made the change in the first place:

But this seems distracting and confusing - many users won't understand what that message has to do with the tool, and whether they should undo the authorization or not.

Is there another option I'm missing? How should I let users undo this account change?

I operate a website for a facility that hosts a public resource for researchers. You can think of it as a shared computing facility.

The website hosts several web-based tools that allows users to interact with and use the resources. Some of these tools are only available to users if they authorize the website to act "as" the user on the compute resources (i.e., the web tool to run command X can only work by having the website process log in to the system as 'user@system' and then run command X).

This involves making a one-time change to the user's account (which is a single account for both the website and the computing facility). It's a serious account change with security implications, so it's important that users understand how to undo it if they every want to.

On visiting the page for these tools, the user will see a message like the following:

If they click "Cancel" they won't be able to use the tool. If they click "Authorize", the necessary change is made to the user's account, and they can use the tool. On future visit to that page, they won't see the message again.

If a user wants to undo this change, they can do that from their user profile page on the website. But since that isn't where they authorized that change in the first place, it may not be obvious to users that they need to go there to undo the change.

The other option I can think of is to remind users that they can undo that change at the top of the page where they made the change in the first place:

But this seems distracting and confusing - many users won't understand what that message has to do with the tool, and whether they should undo the authorization or not. There's already a lot of other things going on in the page.

Is there another option I'm missing? How should I let users undo this account change?