disable - Is it better to prevent a forbidden action or display an error/explanation message?

There are multiple examples, so I'll pick a specific one to focus the question.

Let's say a user can have specific characteristics (or permissions):
Admin, Virtual, External, Financial, etc.

To complicate things, users have different licenses too - Premium, Regular, Limited, etc.

You can probably see where this is going:
Let's say a user with a limited license cannot be an Admin or have financial permissions.

Possibilities:

• The admin goes to the profile of, let's say Zack and sees he cannot allow him to have financial permissions.
  The problem is that it's not clear to the admin why that is (the license info and the permissions are not displayed in the same location and even if they were, the admin would have to be aware of the system rule of "no financial permissions for limited users")


• The admin sees all the permissions (let's assume implemented via checkboxes) enabled and only when clicking gets an error message informing why the operation was denied.
  Now the reason is clear, but the admin had to "waste" a click to find that out.

Is there a way to both prevent the action and also explain why? Would a disabled control with a tooltip work? Any better ideas?

To briefly mention other examples - let's say you have an interactive graph and you can move most of the points on the graph, but some have to be stationary. You could draw them differently to indicate they cannot be moved (without explaining why), or you could let the user try to drag them and then show an error message.

Answer

Depending on the application, I often just don't display the parts of the page a user doesn't have access to. It sounds like you have users changing other user's rights, so this method may not work. I would recommend displaying an error message whenever you display a disabled input element. Users can become frustrated when they are unable to perform an action they expect to be able to do. If it is just disabled, they probably wont understand why and will just take it out on the program. Likewise, you want to make sure the message is as simple as possible and to the point. Long error messages are often ignored.