Setting an employee's scope

You need: employees:read and employees:write — held by admin and employee_manager.

Scope is set once per employee and applies to everything they do. See Scope: what data an employee can see for the model; this page is the task.

Before you start

Decide which of the two modes the person needs:

• Customer — they legitimately need the whole chain. Management, analysts, chain-wide operations.
• Explicit — everyone else. Anyone tied to particular stores or a particular brand.

When in doubt, choose explicit and add to it. Widening a scope later is a one-field change; discovering someone has been seeing another brand's figures for months is not.

Setting an explicit scope

1. Open Scope and find the employee.
2. Switch the mode to Explicit.
3. Fill only the dimensions you actually want to restrict:
   • Brands — leave empty for "all brands".
   • Stores — individual stores, store groupings, or both.
   • Sources — only if the restriction genuinely matters; see the caution below.
4. Save, and confirm the result on a screen the employee uses, such as Reports.

Leaving a dimension empty means no restriction on that dimension — not "no access". An explicit scope with every dimension empty is equivalent to full access.

Using store groupings

Groupings are predefined sets of stores. They combine with individually selected stores rather than replacing them, so you can give someone a region plus one extra store without listing the region store by store.

Prefer a grouping over a long list of store IDs: when a store is added to the region later, the employee's scope follows automatically.

A caution on Sources

The source filter only takes effect in modules that implement it — Reports, Metrics, CMS and some Hub cases. Elsewhere the employee sees everything within their brand and store scope regardless.

This means a source restriction is not a reliable way to hide data in general. Use it to focus a specialised role, not to enforce a boundary. If the boundary matters, express it with brands or stores.

Checking your work

The fastest verification is to look at a screen that shows data volume, such as Reports or the hub order list, and confirm the employee sees what you intended — no more, no less.

Remember that scope does not grant anything. If they see nothing at all, check their roles before adjusting the scope — see How scope works in practice.