Where location scope is configured
A role defines permissions; a user's assignment of that role defines where they apply. With Multiple Locations enabled, the user role assignment page has a separate location picker for each selected role. The shared role definition does not contain a branch access list.
The same Instructor role can be assigned to one teacher at East and another at West. To give one person different permission levels at different locations, assign roles with the required permissions and scope each assignment separately.
Set a user’s role locations
- Open Settings → Roles and Permissions in All locations context.
- On View, open the user to edit their assigned roles, or choose Add users for a new assignment.
- Keep the complete role set the user should have. For each selected role, open its location picker and choose the permitted branches.
- Save, then reopen the user to verify the roles and locations.
No locations selected means All locations. Clearing the picker does not revoke access. To remove a role's access, remove that role assignment. To narrow access, explicitly select the allowed locations.
How multiple roles combine
Multiple roles add permissions; they do not subtract them. For the applicable location, Edit takes precedence over View, and None in one role does not cancel a grant in another. Review all of a user's assigned roles when access is broader than expected. Keep the core Instructor role for teaching identity; reduce its shared permissions before adding custom roles for extra responsibilities.
Example: manager at East, instructor at West
Assign Manager to Alice for East and Instructor for West. She receives each role's configured permissions at its selected branch. If you also give her an unrestricted Manager assignment, that grant is available at all branches; the narrower Instructor assignment does not cancel it. A branch-limited role does not by itself authorize an All locations view—switch to the permitted branch when checking access.
