Roles and scope: the two ideas
Audience: Platform administrators who decide who can do what in the console. You need: the Assignments and Scope sections, available to
adminandemployee_manager.
Access in the console is built on two independent ideas. Keeping them apart is the key to the whole model.
| Concept | What it defines | Where it's configured |
|---|---|---|
| Roles | What an employee can do — actions and modules | Assigned to the employee; one or more |
| Scope | What data an employee can see — brands, stores, sources | Configured once, per employee |
An employee can hold several roles at once. The permissions from all of them are combined. The scope, by contrast, is always shared — it applies equally to everything that employee can do.
Why this separation matters
It means you never have to choose between "can operate the hub" and "can only see two stores". Those are answered separately:
- Give them
hub_operator→ they can work the hub. - Set their scope to stores 1 and 2 → they only ever see those two stores' data, in the hub and everywhere else.
Adding a second role later — reports, for example — does not widen what data they see. The scope still holds.
The three things you'll configure
| You want to… | Go to |
|---|---|
| Let someone do something new | Managing roles from the console |
| Change what data they can see | Setting an employee's scope |
| Grant or block one specific ability, just for them | Individual permission exceptions |
Roles decide what someone can do; their staff record is separate — see Employees: what this area covers.
Where to read next
- Scope: what data an employee can see — the two modes and the three dimensions
- The role catalogue — every role and who it's for
- Access by section — the full grid of role against console section