Platform, Company, and user boundaries
How System scope, Company isolation, and the signed-in user constrain access.
remoteEaze separates users who work across Companies from users who belong to one Company. This boundary is applied before ordinary business access is considered.
L0 System administrators
The reserved System Administrator role operates at L0. It can work across all Companies and bypasses the ordinary Role matrix, data-access scope, and conditional access policies.
L0 comes only from the reserved System Administrator role. Giving another Role a powerful name or selecting System as a user's data-access scope does not turn that user into an L0 administrator. The reserved Role is protected and cannot be edited or copied as a Role template.
Other System users
A System user can be assigned a System Role with a narrower permission matrix. The user can work across Companies only for the entities and actions allowed by that Role. Unlike L0, the user does not bypass permissions or the controls that apply to the selected Company.
Cross-Company screens show a Company selector. Confirm the selected Company before creating, changing, approving, or exporting data.
Company users
An Internal or External user belongs to one Company and cannot use a permission from that Company to access another Company's records. A tenant administrator can have broad permissions within their Company without receiving cross-Company System access.
In simple terms, the Role determines what the user can do inside the allowed boundary. It never moves a Company user into a different Company.
User type and data scope
| User type | Available scope |
|---|---|
| System | Cross-Company System scope, limited by the Role unless the user has the reserved L0 Role. |
| Internal | Organization, Branch, or Self within the user's Company. |
| External | Organization, Branch, or Self within the user's Company. |
Internal and External users require a primary branch. Their primary branch and any selected Accessible Branches are used when Branch scope is applied. See Data-access scope.
Time-based user restrictions
An Internal or External user's access can be limited by working hours, non-working days, weekend access, and holiday access. If no working-hours window is configured, that time-window restriction is not applied. System users are not subject to a Company's working-hours restriction.
These restrictions control when a user may sign in. They do not grant permissions or expand data-access scope.