Roles and scope: the two ideas

Audience: Platform administrators who decide who can do what in the console.
You need: the Assignments and Scope sections, available to 
admin and 
employee_manager.
Access in the console is built on two independent ideas. Keeping them apart is the key to the whole model.
Concept
What it defines
Where it's configured
Roles
What an employee can do — actions and modules
Assigned to the employee; one or more
Scope
What data an employee can see — brands, stores, sources
Configured once, per employee
An employee can hold several roles at once. The permissions from all of them are combined. The scope, by contrast, is always shared — it applies equally to everything that employee can do.
Why this separation matters
It means you never have to choose between "can operate the hub" and "can only see two stores". Those are answered separately:
Give them 
hub_operator → they can work the hub.
Set their scope to stores 1 and 2 → they only ever see those two stores' data, in the hub and everywhere else.
Adding a second role later — reports, for example — does not widen what data they see. The scope still holds.
The three things you'll configure
You want to…
Go to
Let someone do something new
Managing roles from the console
Change what data they can see
Setting an employee's scope
Grant or block one specific ability, just for them
Individual permission exceptions
Roles decide what someone can do; their staff record is separate — see Employees: what this area covers.
Where to read next
Scope: what data an employee can see — the two modes and the three dimensions
The role catalogue — every role and who it's for
Access by section — the full grid of role against console section