Where would users expect to undo a major account change that was made outside of user profile page?

Question

I operate a website for a facility that hosts a public resource for researchers. You can think of it as a shared computing facility.

The website hosts several web-based tools that allows users to interact with and use the resources. Some of these tools are only available to users if they authorize the website to act "as" the user on the compute resources (i.e., the web tool to run command X can only work by having the website process log in to the system as 'user@system' and then run command X).

This involves making a one-time change to the user's account (which is a single account for both the website and the computing facility). It's a serious account change with security implications, so it's important that users understand how to undo it if they every want to.

On visiting the page for these tools, the user will see a message like the following:

If they click "Cancel" they won't be able to use the tool. If they click "Authorize", the necessary change is made to the user's account, and they can use the tool. On future visit to that page, they won't see the message again.

If a user wants to undo this change, they can do that from their user profile page on the website. But since that isn't where they authorized that change in the first place, it may not be obvious to users that they need to go there to undo the change.

The other option I can think of is to remind users that they can undo that change at the top of the page where they made the change in the first place:

But this seems distracting and confusing - many users won't understand what that message has to do with the tool, and whether they should undo the authorization or not. There's already a lot of other things going on in the page.

Is there another option I'm missing? How should I let users undo this account change?

Answer 1

Judging from what you have written it seems that it should be clear for the user that the website is working in the "authorized" mode. Therefore the current authorization status should be displayed when interacting with the page- maybe it could be placed in some sort of activity / status placeholder that you could then later use for other important statuses / messages too?

In my opinion it does not have to be so much "in-your-face" as the screenshot you have provided with the box on the top and "undo authorization" button. Maybe there should be a box or just a text saying something like : "Status: Authorized" with an info icon. When the user is interested in finding more about it he can hover over / click on it. An option for changing this status could be provided (either in a box or on a separate page) and an explanation of what this status is all about.

In this way you will not overwhelm the user with too much information but provide it only if the user is interested in reading more or authorizing / de-authorizing access.

Answer 2

Take cue from Twitter or Facebook, I would suggest you create a listing page where all 3rd party apps are listed in a chronological order with a De-authorization button adjacent to each app. That should keep the interface clutter free, less complicated.