How access works
Access in Yessort answers two questions, separately.
What can this person do? Their role.
Where can they do it? Their site scope.
The two never mix
A role grants capabilities: read orders, update stock, approve purchase orders. It says nothing about location.
A site scope narrows which sites a person sees and acts on. It grants no capability and removes none — someone limited to one warehouse can do exactly the same things there as they could anywhere, they simply cannot see the others.
So the two are set independently, and changing one never changes the other. Giving someone a wider role does not widen where they work; limiting their sites does not reduce what they may do.
This separation is deliberate. It keeps each question answerable on its own, and it means a change to one axis cannot quietly alter the other.
What a check actually does
When Yessort decides whether someone may do something, it resolves the permission through a matrix of resources and actions. It never checks the role by name.
That is worth knowing because of what follows from it: if you change what "member" grants in your organisation, behaviour changes immediately. Nothing in Yessort is written to behave one way for a member and another for a warehouse user — the names are labels over a matrix you control.
See editing what a role can do and the permission matrix.
Visibility is a third thing
Neither axis decides which organisations someone can see. That follows from which organisations the person belongs to, and nothing else.
This matters most on a shared site, where several organisations hold stock in one building. A role grants no extra visibility there — see who sees what.
So there are really three questions, and it is worth keeping them apart:
| Question | Decided by |
|---|---|
| Which organisations can I see? | Which ones I belong to |
| What can I do in this one? | My role |
| Where can I do it? | My site scope |
Where the settings live
Roles and site scope are set per member, under the organisation's Members. Both need organisation-admin access.
What each role grants is edited under the organisation's role settings.
Owners and admins
Owners and admins are never site-limited, whatever scope rows exist for them. They run the organisation, so restricting where they can act would not be meaningful.
The owner role's permissions are also fixed and cannot be edited — the backstop that stops an organisation removing its own ability to administer itself.