All courses

Scopes: what each person sees and writes

How to limit a reader or an editor to part of the catalog, and to the attributes of their groups.

Video transcript

In this video, you'll limit a person to part of the catalog.

A scope limits a viewer or an editor to part of the catalog; you set it from their row, with “Scope”.

For reading: categories, families or brands. The person only sees those products; it's a supplier's scope.

For writing: attribute groups. They see the whole record, but only write the attributes in their groups.

This is how the supplier sees it: their catalog only has their brand's products.

In the record, what isn't theirs has a lock; if they try to write it, the server rejects it.

In the next video, you'll leave notes for your team inside each product.

What a scope is

A scope limits one person on the team. Only a reader or an editor can be scoped: an operator, an administrator or an owner imports, downloads and bulk-deletes, and those actions cannot be scoped without lying.

You set and remove it from Settings → Team, on the person's row, with «Scope». It is an administrator action and the log records how many categories, families, brands and groups were scoped.

Read: categories and families

Checking categories or families makes the person see only the products in those categories (with all their subcategories) or in those families. A product in none of them does not exist for that person: it is not listed and its page answers “not found”. With nothing checked, they see the whole catalog.

Someone scoped for reading also does not see what belongs to the whole organization: credits, the generations gallery, the review queue, batches, analytics or the log. From the team they see the unscoped staff, not other scoped people, and from saved views only their own. Search, the grid, the image library and the home counts show them only their part of the catalog.

A product with no category and no family is outside every read scope. In a freshly imported catalog that is the whole catalog: scope people after organizing it.

Reading: brands

Checking brands makes the person see and edit only the products of those brands. It is a supplier's scope. It adds up with categories and families: if you check a category and a brand, they see the products of both.

Someone scoped by brand can only create products of their brands. And nobody who is scoped can change a product's brand: moving it to another brand would take it out of their scope or put it in someone else's.

The brand comes from the brand text of each product. «NYX» and «nyx» are the same brand; if an import changes a product's brand to another one, that product moves to the other brand and leaves the scope of whoever had the first. A product without a brand is not in any brand scope.

Write: attribute groups

Checking attribute groups makes the person see the whole sheet but write only the values of the attributes in those groups. The others show a lock, on the sheet and in the grid; if they try to write one, the server rejects it naming the attribute and the group.

Attributes without a group (“Other”) are in no scope: only unscoped people write them. That is why it pays to split the sheet into groups before scoping anyone.

The group lock and the “Protected” mark are two different things on the same attribute: one splits by team, the other reserves it for administrators. Both apply.

API keys are not scoped

An API key authorizes by permissions (scopes), not by role or scope: whoever issues a key with attributes:write grants permission to write the whole catalog. If an integration must touch only a part, the key does not carry that permission, or the integration filters by the group field each attribute carries in the API.