Skip to content
Decide who may open what, across companies and branches · presentation 2 of 5 · for the whole-system operator — you run the books Read the transcript · Back to the series

These slides need JavaScript to advance one at a time. Without it every slide is shown below, one after another, each with its own player — or read the transcript, which carries the same steps and every word.

Decide who may open what, across companies and branches · presentation 2 of 5

A target restricts documents, and not your customer list

You can say which screens a company, branch or location target really narrows, which ones it never touches…

What you actually set

Step 1 — Set the target, and know what you have written

You will read the Permission Sets screen accurately.

Screen capture pending the demo tenant

Tenant Admin, a role's Applet tab, the Permission Sets sub-tabs for Branch, Company and Location

Step 2 — See it work on documents, which is where it bites

You will know the case the mechanism was built for.

What this step names
  1. When the server answers a request for documents — invoices
  2. Orders
  3. Receipts
  4. Stock takes — it puts your grant's company
  5. Branch
  6. Location into the query itself and returns only the rows you are…

Where it stops

Step 3 — Then watch it not happen on the customer list

You will stop relying on the thing most people rely on.

  • Ask the same server for customers, and it checks that you hold the read…
Screen capture pending the demo tenant

The customer search in a document, returning a customer from another branch

Step 4 — Understand why it stops there, because the reason is useful

You will predict which other screens behave which way.

What this step names
  1. The permission layer hands each endpoint the list of companies
  2. Branches and locations you are permitted
  3. It is the endpoint's own query that has to use them —…

What you will actually see

Step 5 — Meet the symptom before your users do

You will recognise the commonest access complaint on sight.

Screen capture pending the demo tenant

A new sales invoice with an empty Company selector

Step 6 — Design the boundary where the boundary holds

You will have something you can defend.

What you do
  1. Keep the controls that genuinely are server-side and separately granted — being able to…

NarrationSlide 1 of 10

Left and right arrows, or the space bar, move between slides; f is full screen and Esc leaves it. Clicking the left or right half of a slide pages it. Play and pause belong to you — nothing moves on by itself unless you tick the box above.