Data-access scope
How System, Organization, Branch, and Self scope determine which records a user can use.
An entity permission answers, "What can this Role do?" Data-access scope answers, "Which records can this user do it to?" Both checks must pass.
Available scopes
| Scope | Current meaning |
|---|---|
| System | Cross-Company scope for System users. The user's Role still limits the allowed actions unless it is the reserved L0 Role. |
| Organization | Records within the user's Company. |
| Branch | Records connected to the user's accessible branches, using the rule defined for each entity. |
| Self | Records connected to the user, using the ownership or assignment rule defined for each entity. |
The user form shows Organization, Branch, and Self for Internal and External users. System users receive System scope.
Branch scope
For Branch scope, remoteEaze determines the accessible branches as follows:
- If Accessible Branches contains one or more branches, those selections form the accessible set.
- If it is empty, only the user's primary branch is accessible.
Leaving Accessible Branches empty does not give a Branch-scoped user access to the whole Company. For Organization and Self scope, this field does not add another restriction.
For a record that belongs directly to a branch, that branch must be accessible. Some records use the branch of a related Customer or Account instead.
Self scope
Self scope does not always mean "created by me." Depending on the entity, the user can be recognized through ownership, an Agent link, a relationship-officer assignment, creation or modification history, or an active workflow assignment.
The relevant relationship is checked separately for each record. Being able to use one Customer's record does not automatically make every record related to that Customer available.
Transaction-family scope
Transactions, Forward-Dated Transactions, and Standing Orders share the same booking-branch rule.
For a Branch-scoped user:
- authorization uses the header Transaction Branch;
- individual line branches and Account branches do not each have to be in the approver's accessible set;
- makers can also see instructions they created or last changed;
- an immediate Transaction also recognizes the posting user stored in its metadata.
This rule allows one Transaction to contain lines involving several branches while keeping authorization with its booking branch.
Scope does not replace permission
A user can have a record in scope but lack Update or the required approval authority. A Role can also have L1 Approver while a particular record remains outside the user's scope.