Only a user assigned to the Provisioning Manager role can define users and groups. See the Oracle Hyperion Enterprise Performance Management System User and Role Security Guide.
To select users and groups for an application:
From the Shared Services Console, expand Application Groups, right-click the application name, select Assign Access Control, and then Select Users and Groups.
Show All to show all users that are provisioned
Users or Groups, and in Search Criteria, enter search criteria, and click Search.
From Available Users and Groups, select users and groups to assign to the application and select roles, and use the arrow keys to move them to the Selected Users column.