Role reach decides how much of the organisation tree a user's role covers. It applies to the user roles (User Risk, User Privacy, User Compliance, Auditor, Read and sign) and to custom roles. Administrator roles always reach downwards, whatever this setting says. For the overall picture, see How access works.
| A user with a role in this organisation… | |
|---|---|
| Off (the default) | sees this organisation only. The role applies only where it is held, and the user can switch only between the organisations they are a member of. |
| On | also sees every organisation below it. Their lists show the records of the organisation they are working in together with those of the organisations below it, and they can switch into any of them. Their role applies there, unless they hold a role of their own there. |
Off is the right choice for organisations that want each unit kept to itself, for example a group where subsidiaries must not see each other's work. On suits organisations where people at one level work across the units below them, for example a faculty with many departments.
The Effect now line under the switch tells you what the setting does there, for example that a role here sees this organisation and 95 below. Users get the change the next time they switch organisation or reload the page.
Roles never combine. In the organisation the user is working in, a role they hold there wins. If they hold none there, the nearest role above that reaches down applies. Example: a user who is User Privacy at a faculty and User Risk at a department below it works as User Risk in the department and everything under it.
Role reach decides how far a user sees; restricted roles decide what they may open. A restricted user with role reach on still sees the organisations below, and opens only their own records and what is shared with them across all of them. See What they may open: restricted roles.