The user-management page groups email addresses by role. Adding a person means creating or updating a membership for the selected role; it does not copy one universal permission set to the user.
Use the short undo opportunity if the wrong member was selected.
Verify whether the person has access through another role.
Removing one membership may not remove all access
A user can belong to multiple roles. Search the full user-management view before concluding that an email address no longer has access to the company or asset.