Can I restrict what a user sees and edits in the admin?
Yes. Roles scope access by site, section, content type, and action, so a user only sees what they need. Changes can require approval before going live, and every edit is logged.
Platform & Architecture
Yes. Access in Core dna is controlled by roles rather than per-person settings, and a role can be scoped narrowly enough that a user only ever sees the part of the platform they work in.
You can restrict on several axes at once:
- By site or location. In a multi-site, franchise, or dealer network, a user can be limited to their own site and nothing else.
- By section. Grant access to specific areas of the admin and hide the rest.
- By content type. Full edit on local promotions, view-only on the shared product catalog, no access to brand templates.
- By action. Being able to see a record is separate from being able to edit, publish, or delete it.
Two controls sit on top of that. Approval gates can require sign-off before a specific change goes live, which is how central teams keep brand and legal copy locked while still letting local editors work. And an audit trail records every change against the user who made it, so an over-broad permission shows up rather than staying silent.
The recommended starting point is least privilege: grant the narrowest role that lets someone do their job, then widen it if they need more. To create the accounts themselves, see adding users and setting up their access.
More reading
Related posts
