The permissions course — who sees what, who may do what, and why

One goal: leave this page genuinely understanding the access model, not memorising steps. We start with why access control exists, then the one big idea everything is built on, then the seven scopes one by one with workplace examples, and we close with denials, separation of duties, and delegation.

The big idea: a permission = an action + a scope

There is no such thing as "Mona can read salaries", full stop. The question always completes: read whose salaries? Her own? Her team's? Her company's? Everyone's? So every grant has two halves: the action (what is allowed — "read employees", "approve leave") and the scope (over whom). The Add-permission dialog shows exactly these two: the permission catalogue on top, the scope picker beneath it. An action without a scope is meaningless and the system won't accept one.

The seven scopes, narrowest to widest

Self only The person's own record. The ordinary employee's scope: my file, my payslip, my leave.

Direct reports The manager's immediate team: everyone in the manager's own department plus the managers of the departments directly beneath it — not everyone below those.

Reporting chain Everyone beneath the person, all the way down.

Department A department and its whole subtree. Unconstrained it means the actor's own department; constrained it names a specific one.

Legal entity One whole company of the group — all its branches and departments, and not one step into a sister company. Granted on the holding, it covers the subsidiaries too.

Location One branch, whatever departments its people belong to.

All The entire tenant. Central roles only — ask twice before granting it.

Scopes never widen by themselves — someone needing two scopes is granted both, explicitly. And the population scopes are derived from the org chart at the moment of the check, never stored: move an employee and the old manager stops seeing them while the new manager starts, within seconds, with no admin action.

The real Add-permission dialog: the permission catalogue search on top, and the scope list open beneath showing all seven scopes — The real screen: search the **action** in the catalogue on top, pick the **scope** beneath — the same seven scopes just explained.

Granting in practice

Open the person in access administration → Add permission → search the action → pick the scope → write the reason → save; optionally set an expiry so the grant dies by itself. For recurring jobs use roles — pre-built bundles like "HR officer" — and keep individual grants for exceptions.

Denials win; duties separate

A denial beats every role, grant and delegation, instantly — the emergency brake when someone must be stopped without hunting where the access came from. And some permission pairs refuse to combine at all: whoever prepares a payroll run cannot also release it. Holding both blocks the action with a message naming the conflict — the simplest guarantee against both error and fraud, applied to humans and automated jobs alike.

Delegation

Travelling? Delegate your approvals: pick what, pick the dates (expiry is mandatory), and the colleague must accept before anything happens. Everything they do is recorded in their own name marked "on behalf of you". Crucially, the scopes resolve from your seat: delegated "approve leave for direct reports" means your reports, never theirs. And a delegate cannot re-delegate. Cancel any time; it stops immediately.

Recipes

New HR officer works Distribution Co. only

HR-officer role, employee scopes at Legal entity constrained to Distribution. Manufacturing employees will not even appear in her searches.

Branch manager follows his branch's attendance

Attendance-read at Location, constrained to his branch.

Auditor needs everything for one week

Temporary grant at All with a written reason and a 7-day expiry — it dies on its own.

Stop someone approving, right now

Add a denial on the approval action. It wins over every source from that second.

Summary. Every permission is an action over a scope; seven scopes from Self to All, computed live from the org chart. Roles for the recurring, grants for exceptions, denials win over everything, conflicting duties refuse to combine, and delegation covers absence — accepted, attributed, anchored on the delegator, and time-boxed.