Location-Scoped Access: Controlling What Each Employee Can See Across Stores

Location-scoped access means an employee's login only shows the data and functions of the specific store (or stores) they work at — not every location you own. A cashier at your downtown store shouldn't be able to pull up sales totals, inventory counts, or customer phone numbers from your location across town, and in most retail systems, once you add a second store, that separation doesn't happen automatically. Retailer OS handles it through roles that are scoped to locations, so access follows the org chart instead of being all-or-nothing.

What does "location-scoped" actually mean?

Location-scoped access is a permission setting that limits what a user can see and do to the specific store, stores, or warehouse they're assigned to — rather than every location on the account. It's different from a role permission like "can process refunds," which controls an action. Location scope controls the slice of the business that permission applies to. A store manager might be allowed to void a sale (an action permission) but only at the one store they manage (a location scope) — not at the five other stores in the chain.

Why can't every employee just see everything?

For a single-store shop, this question doesn't come up. The moment you open a second location, three problems show up fast:

• Competitive and privacy exposure — staff at Store A can see Store B's daily revenue, margins, and customer purchase history, which most owners don't want shared past the people who need it.
• Accidental changes in the wrong place — a user who can see every location's inventory can also edit it, which means a stock adjustment meant for one store's count can get entered against the wrong one.
• Noise that hides real problems — a manager trying to review their own store's register-close variance shouldn't have to filter past four other locations' data every time they open a report.
• No accountability trail — if everyone has the same broad access, it's harder to narrow down who could have made a given change when something looks off.

This is a different problem from register-level controls like who can issue a refund or override a price — that's covered in POS user roles and permissions: who should be able to void, refund, and discount?. Location scope is about *where* a permission applies, not just *what* it allows.

How do custom roles with location-scoped access work in Retailer OS?

Retailer OS ships with built-in roles — owner, admin, manager, cashier, and viewer — and lets you build custom roles on top of them for a title like "Regional Manager" or "Receiving Clerk" with exactly the permissions that job needs. Every one of those roles, built-in or custom, can be scoped to one location, a set of locations, or all locations on the account. Staff assigned to a single store simply don't see sales, inventory, customers, or reports from any other location — the data isn't hidden behind a filter they could toggle off, it's not part of their login at all.

On top of location scope, Retailer OS lets you set reporting lines — who reports to whom — so a district manager's view can be built around the stores their direct reports run, without needing full all-locations access to every part of the business. This is covered in more detail in multi-location retail management, which is where location assignment and team access live in the product.

What should different roles actually be able to see?

There's no single right answer, but most multi-location retailers land somewhere close to this breakdown:

• Cashier — scoped to their one store. Can ring sales, process the permitted tenders, and see that store's catalog and stock. No visibility into other locations' numbers.
• Store manager — scoped to their one store (or a small set, for managers who float between two nearby locations). Full view of that store's inventory ledger, purchase orders, schedule, and daily reports.
• Regional or district manager — scoped to the set of stores they're responsible for, using reporting lines so their dashboard reflects their own district rather than the whole chain.
• Bookkeeper or accountant — often scoped to all locations for reconciliation purposes, since card reconciliation matches register payments against the store's own Stripe account and vendor bills often get entered centrally.
• Owner — all-locations visibility by default, with the ability to grant that same breadth to a trusted few without handing it to everyone.

A quick example

A three-store boutique chain might run it like this: cashiers see only their assigned store, each store manager is scoped to their own location and reports to the owner, and the owner keeps all-locations access alongside a part-time bookkeeper who also needs to see every store to reconcile vendor bills and card deposits across the chain. None of these roles require custom code — they're built-in roles with the location scope set when the person is invited.

How do you set up location-scoped roles, step by step?

If you're adding a second location or cleaning up access on an existing multi-store account, the setup is straightforward:

• 1. Add each physical location as a store in the account — each one, whether it's a shop, warehouse, van, or pop-up, is billed as its own store.
• 2. Invite each staff member as a user with their own login — shared logins make it impossible to tell who did what later.
• 3. Assign a role — start from a built-in role (owner, admin, manager, cashier, viewer) or build a custom role if the job doesn't map cleanly to one of those.
• 4. Scope the role to the right location or locations — a single store for most front-line staff, a named set for floating or regional staff, all locations for owners and central finance roles.
• 5. Set reporting lines where it matters, so a manager's rolled-up view reflects the people and stores under them rather than requiring a broader permission set.
• 6. Review the audit log periodically to confirm access matches who's actually working where, especially after someone changes locations or leaves.

What about owners who run more than one store account?

Location scope inside one account is different from comparing multiple store *accounts* you own. If you run separate Retailer OS accounts — for example, because the stores were set up at different times or under different entities — the corporate roll-up compares revenue, orders, average ticket, and margin across the accounts you personally belong to, without giving every staff member that cross-account view. That comparison is covered in comparing sales across multiple store locations. Location scoping, by contrast, is about access *within* a single account across its locations — the more common case for a growing chain.

Does location scope affect inventory and transfers too?

Yes — and this is where it matters beyond just reports. Because Retailer OS keeps one shared inventory ledger across every location, a user scoped to Store A can still see that stock is in transit to them from Store B (so they know what's coming), without being able to view or edit Store B's full stock count or pricing. That balance — visibility into what affects you, without blanket access to everything — is also why location scope pairs naturally with transfer tracking; see multi-location inventory management: transfers, par levels, and one source of truth for how stock movement between locations is tracked end to end.

How Retailer OS handles this in practice

Retailer OS keeps workforce and access control inside the same system that runs the register and the stock ledger, rather than a separate identity tool bolted on afterward. In practice that means:

• Built-in roles (owner, admin, manager, cashier, viewer) and custom roles you define yourself, each with its own set of permissions.
• Every role — built-in or custom — can be scoped to one location, several, or all of them.
• Reporting lines, so a manager's view reflects the staff and stores assigned to them.
• A manager mobile view for checking on a store without being tied to the back office.
• An audit log of changes, so you can confirm who did what and when, independent of what they were scoped to see.
• Pricing that's per store ($99.99/month) and per user seat ($9.99/month) — see pricing — so adding a scoped role for a new hire or a new location doesn't require a separate access-management product.

This lives alongside the rest of staff operations — scheduling, time clock, roles — in retail workforce operations, and alongside stock visibility by location in multi-location inventory without spreadsheets.