add default perms info

Author: paulOsinski

docs/content/admin/user_management/about_perms_and_roles.md

@@ -71,6 +71,7 @@ Superusers (Admins) have no limitations in the system. They can change all setti
 
 By default, the first account created on a new DefectDojo instance will have Superuser permissions. That user will be able to edit permissions for all subsequent DefectDojo users. Only an existing Superuser can add another superuser, or add a Global Role to a user. 
 
+
 ## Configuration Permissions
 
 Configuration Permissions, although similar, are not related to Products or Roles. They must be assigned separately from Roles. **Regular** **users do not have any Configuration Permissions by default, and assigning these configuration permissions should be done carefully.**
@@ -90,3 +91,21 @@ If users are part of a Group, they also have Group Configuration Permissions whi
 If users create a new Group, they will be given the Owner role of the new Group by default.
 
 For more information on Configuration Permissions, see our **[Configuration Permissions Chart](../user_permission_chart/#configuration-permission-chart)**.
+
+## Manage default permissions
+
+When a brand new user is created in DefectDojo — whether manually, via SAML / SSO, or via any social-auth provider — they have **no permissions by default**. They will see zero Product Types, zero Products, and zero Engagements when they first log in. They cannot view or interact with any data until a Superuser grants them access (directly, via a Global Role, via a Product / Product Type membership, or by adding them to a Group).
+
+If you want every newly provisioned user to receive a baseline level of access automatically — for example, "every new SSO user should be a Reader on a particular group" — you can configure a **Default group** on the System Settings page.
+
+1. Open **⚙️ Configuration → System Settings** (Superuser only).
+2. Set **Default group** to the [User Group](../create_user_group/) that newly created users should join.
+3. Set **Default group role** to the role they should hold in that group (e.g. **Reader**).
+4. Optionally set **Default group email pattern** to a regex (e.g. `.*@yourcompany\.com$`) so the default group is only applied to users whose email matches.
+5. Save.
+
+Both **Default group** and **Default group role** must be set — if either is empty, the default group is not applied.
+
+This setting applies to every user-creation path: manual creation, SAML, OAuth, and other social-auth providers. It is not applied retroactively — existing users will keep their current group memberships even if you change this setting later.
+
+For SSO-specific guidance, see [SAML Configuration](/admin/sso/pro__saml/#default-access-for-sso-provisioned-users) or your provider's section under [SSO Configuration](../configure_sso/).