How Role × Location Membership Controls What Users

1. The Two Keys

Access in Xenia works like a two-key lock. To access something, a user needs both keys simultaneously:

Key 1 — Role: The role determines what features and permission levels the user has across the workspace. Which tabs they can see. Whether they can manage templates or just submit them. Whether they see only their own tasks or everyone's tasks at their location.

Key 2 — Location Membership: The location determines which stores' data the user can access. A District Manager role might grant "view all tasks at your locations" — but the locations themselves are controlled by membership. The DM only sees data from stores explicitly added to their location membership list.

Neither key alone is enough. A powerful role with no location membership means the user has access to features but sees nothing at any store. A broad location membership with a restrictive role means the user is assigned to many stores but can only perform limited actions. 

2. How It Works in Practice

Example 1 — Store Manager at Store 5:

• Role: Store Manager (can view tasks + others' tasks at their location)
• Location membership: Store 5 only
• Result: Sees all tasks and submissions at Store 5. Nothing from any other store.

Example 2 — District Manager for Stores 1–5:

• Role: District Manager (view all tasks, view all submissions)
• Location membership: Stores 1, 2, 3, 4, 5
• Result: Sees everything across those 5 stores. Nothing from Stores 6+.
• Add Store 6 to their membership → immediately sees Store 6's data. No role change needed.

Example 3 — HR Manager with workspace-wide access:

• Role: HR Manager (view all submissions for HR templates, Tier 3 access)
• Location membership: All locations (or no location membership required if using Tier 3 submission access)
• Result: Can view HR-related submissions from every location. 

3. Why This Matters for Troubleshooting

"A user can't see a submission." First question: what is their submission access tier on that template, AND do they have location membership at the location where it was submitted?

"A notification went to the wrong person." Usually: either the wrong role is configured as the recipient, or the role member doesn't have location membership at the relevant store.

"A new store was added and the manager doesn't see it." Fix: add the new store to the manager's location membership. No role change needed.

"A user was reassigned to a new district." Fix: update their location membership — remove old stores, add new ones. The role stays the same.