Assign business-unit access
Use Authorization → User business unit access to choose where a user may operate. The page is separate from roles because a person may have the same job in one branch or several.
Screen controls
| Control | Behaviour |
|---|---|
| User | Select an enabled user; confirm username/email |
| Unit checkboxes | Select active operating units the user should access |
| Select All | Selects the active choices currently offered; review before saving |
| Clear All | Clears the form selection; the current page cannot save an entirely empty access set |
| Primary Business Unit | Must be one of the selected units |
| Save Access | Writes unit decisions and then reloads saved access on success |
Steps
- Select the intended User and wait for current access to load.
- Review the entire active-unit list. Assignment administrators can be offered tenant units beyond their own operational grants.
- Select only the units this user should access.
- Choose one selected Primary Business Unit.
- Choose Save Access and wait for success.
- Re-select/reload the user and verify both selections and primary unit.
- Have the user refresh their working session and verify the intended unit-specific workflow.
Example
Farah works at North only: select BHS-NORTH and make it primary. Nadia covers both branches: select North and South, then choose her usual branch as primary. Neither assignment grants receipt posting; that still comes from roles.
The saved access types are PRIMARY, ALLOWED and DENIED. The current page requires at least one selected unit and a primary, despite offering “No primary business unit” as a control value. Choosing that value will not pass save validation.
Important save boundary
The page sends a sequence of unit decisions, with the primary promotion last. It is not one atomic bulk replacement. If a later request fails, earlier decisions may already be saved. Reload the user, inspect actual grants and primary, then correct the remaining differences. Do not assume the old state was restored.
Unchecked active units are submitted as DENIED. This is different from the separate DELETE removal endpoint. Inactive units are not displayed in the active choices; do not assume this screen inventories every historical grant.
Administrator targets need admin.view for reads and both admin.view and admin.update for assignment/removal, in addition to the scope operation authority. This includes the caller's own administrator account and owner targets.