# Roles and scope: the two ideas

> **Audience:** Platform administrators who decide who can do what in the console.
> **You need:** the Assignments and Scope sections, available to `admin` and `employee_manager`.

Access in the console is built on two independent ideas. Keeping them apart is the key to the whole model.

| Concept | What it defines | Where it's configured |
|---|---|---|
| **Roles** | What an employee **can do** — actions and modules | Assigned to the employee; one or more |
| **Scope** | What data an employee **can see** — brands, stores, sources | Configured once, per employee |

An employee can hold several roles at once. The permissions from all of them are combined. The scope, by contrast, is always **shared** — it applies equally to everything that employee can do.

## Why this separation matters

It means you never have to choose between "can operate the hub" and "can only see two stores". Those are answered separately:

- Give them `hub_operator` → they can work the hub.
- Set their scope to stores 1 and 2 → they only ever see those two stores' data, in the hub and everywhere else.

Adding a second role later — reports, for example — does not widen what data they see. The scope still holds.

## The three things you'll configure

| You want to… | Go to |
|---|---|
| Let someone do something new | [Managing roles from the console](/books/console-yF7/page/managing-roles-from-the-console) |
| Change what data they can see | [Setting an employee's scope](/books/console-yF7/page/setting-an-employees-scope) |
| Grant or block one specific ability, just for them | [Individual permission exceptions](/books/console-yF7/page/individual-permission-exceptions) |

Roles decide what someone can do; their staff record is separate — see [Employees: what this area covers](/books/console-yF7/page/employees-what-this-area-covers).

## Where to read next

- [Scope: what data an employee can see](/books/console-yF7/page/scope-what-data-an-employee-can-see) — the two modes and the three dimensions
- [The role catalogue](/books/console-yF7/page/the-role-catalogue) — every role and who it's for
- [Access by section](/books/console-yF7/page/access-by-section) — the full grid of role against console section