Start from the effective access question
An administrator may see a user reach more channels or controls than expected and focus on the named user's row alone. Tvheadend's developer documentation describes access checks across enabled matching entries and the combination of several permission-related fields. Review the effective result, not just the most recognisable account label.
Keep the existing administrative recovery route and a protected configuration copy before making changes. Use a trusted local test client and a non-administrative review account. This is a local configuration audit for a server you administer; it is not a route to access someone else's service or a recipe for opening a tuner to the internet.
Record the requesting identity and source address
Create a small matrix containing the account used, the client's source address as seen by the server and each enabled entry that might match. Include the allowed-network scope and any anonymous wildcard entry. The documented matching conditions involve both identity and network context, so testing from another network can change which rows are applicable.
Do not publish real passwords, tokens or a sensitive network map in a public support request. Keep a sanitised summary of the matching logic instead. An apparently harmless anonymous row deserves review even when the user signed in with a name, because the developer notes its broader matching behaviour.
Inspect the combined fields and their controls
For the applicable entries, record the relevant permissions, streaming and DVR profile choices, channel tags and channel ranges. Check the installed version's controls for how parameters merge, and preserve entry order in the record. Do not assume that one narrow row automatically cancels privileges granted elsewhere.
State the intended effective result in plain language, such as viewing a defined authorised subset without administrative controls. Compare each applicable row with that result before editing. Changing several rows at once can make the account appear correct while concealing which entry was responsible for the earlier excess.
Verify least required access without losing administration
Make the smallest reviewed change and test the ordinary tasks the account needs, along with one task it should not have. Confirm the administrative recovery route remains available. Treat a failed test as evidence to revisit the matching matrix; do not respond by adding a broad anonymous entry that restores access indiscriminately.
Record the actual result, version, client context and changed row. No Tvheadend access configuration was installed or tested for this guide. Recheck the matrix after network changes or additional entries, since a new matching rule can change the effective result. Completion means the account's access is explainable across all applicable entries, with a recoverable administration path.
Questions answered
Can I judge a user's access from that named row alone?
No. Review all enabled entries that match the identity and source context, plus the documented combination controls.
Does an anonymous entry matter when a client uses a username?
It can. The developer documentation describes wildcard entries matching any username subject to their network conditions.
Sources & further reading
Official references for the subjects discussed. Service terms and device software can change.