The permissions matrix answers the question "what can they do". Branches and departments answer the question "on whose data". This is the most often overlooked layer, and also the layer that causes the most data leaks.
Three fields that determine scope
| Field | Located in | Effect |
|---|---|---|
| Access group | Employee profile › Work | Selects which permission set in the matrix applies to this person |
| Branch | Employee profile › Work | Limits data by location |
| Department | Employee profile › Work | Limits data by organizational unit |
All three fields appear as columns in the HR list, so you can quickly check the whole company right there without opening each profile.
Three scope levels in practice
| Access group | Can see |
|---|---|
| Manager | The entire company — not limited by branch or department |
| Regional Manager | The group of branches in the region that person is responsible for |
| Branch Manager | Exactly the one branch recorded in the profile |
| Employee | Only their own data |
The most common configuration warning: leaving the branch blank in a Branch Manager's profile. In that case the system has nothing to limit by, and that person may see more than you intended. Before assigning any manager group, make sure that person's profile already has a branch and department.
Assign an access group to an employee
- Go to HR and click the name of the person you want to edit.
- Select the Work tab.
- Click Edit on the section containing the access group, branch and department information.
- Select the access group, branch and department.
- Click Save.
Quick company-wide review
- Go to HR.
- Read the Access group column together with the Branch and Department columns.
- Filter using the three boxes All statuses · All departments · All branches at the top of the list.
- Use Export File to export the entire list to Excel and review it offline.
| Warning sign to review | Why |
|---|---|
| Access group is Manager but the job title is a regular employee | Most likely assigned by mistake — a Manager sees the entire company |
| A manager group but the Branch column is blank | Nothing limits the scope |
| Several people with the same job title but different access groups | Inconsistent, usually a leftover from an earlier data entry |
Recurring tasks
- Monthly: review the Access group column for new hires and people who just changed positions.
- As soon as someone leaves: change the profile status and downgrade the access group, without waiting for the review cycle.
- Quarterly: export the employee list to a file and compare it against the actual org chart.
