Change an officer’s institution
Edit the user in the People list and update the Officer Institution field.
Revoke an officer’s access
The cleanest approach is to set their account status to Blocked in the edit form. This preserves the audit trail (activity log entries still show who did what) while preventing them signing in.
Don’t delete a staff user to revoke access — it would orphan their activity-log entries. Block them instead.