Choosing what each person can see and do

Open Administration, Organization, then Roles. A role groups rights per module: read, create, edit, delete, export, import, administer.

A role is given on one or more entities, or on all of them. This is what lets an accountant see two brands and a salesperson only one.

The SCOPE is set per module in the role and decides what shows up in lists: one's own records, those of one's team, department, entity, or all entities.

The entity selector at the top of the screen NARROWS the view, it never widens it: it cannot show what the roles do not allow.

A module your plan does not open is not opened by a role: the right is the only door, the plan decides what exists.

A role's Mandatory two-factor authentication box requires the second factor from whoever receives it. Unticking it never removes a second factor already set up, and removing it from a role that requires it is reserved to the publisher.