# Setting an employee's scope

> **You need:** `employees:read` and `employees:write` — held by `admin` and `employee_manager`.

Scope is set once per employee and applies to everything they do. See [Scope: what data an employee can see](/books/console-yF7/page/scope-what-data-an-employee-can-see) for the model; this page is the task.

## Before you start

Decide which of the two modes the person needs:

- **Customer** — they legitimately need the whole chain. Management, analysts, chain-wide operations.
- **Explicit** — everyone else. Anyone tied to particular stores or a particular brand.

When in doubt, choose explicit and add to it. Widening a scope later is a one-field change; discovering someone has been seeing another brand's figures for months is not.

## Setting an explicit scope

1. Open **Scope** and find the employee.
2. Switch the mode to **Explicit**.
3. Fill only the dimensions you actually want to restrict:
   - **Brands** — leave empty for "all brands".
   - **Stores** — individual stores, store groupings, or both.
   - **Sources** — only if the restriction genuinely matters; see the caution below.
4. Save, and confirm the result on a screen the employee uses, such as Reports.

> Leaving a dimension empty means **no restriction on that dimension** — not "no access". An explicit scope with every dimension empty is equivalent to full access.

## Using store groupings

Groupings are predefined sets of stores. They combine with individually selected stores rather than replacing them, so you can give someone a region plus one extra store without listing the region store by store.

Prefer a grouping over a long list of store IDs: when a store is added to the region later, the employee's scope follows automatically.

## A caution on Sources

The source filter only takes effect in modules that implement it — Reports, Metrics, CMS and some Hub cases. Elsewhere the employee sees everything within their brand and store scope regardless.

This means a source restriction is **not** a reliable way to hide data in general. Use it to focus a specialised role, not to enforce a boundary. If the boundary matters, express it with brands or stores.

## Checking your work

The fastest verification is to look at a screen that shows data volume, such as Reports or the hub order list, and confirm the employee sees what you intended — no more, no less.

Remember that scope does not grant anything. If they see nothing at all, check their roles before adjusting the scope — see [How scope works in practice](/books/console-yF7/page/how-scope-works-in-practice).