Franchise and multi-branch hub: head office sees everything, a franchisee sees their branch

Roles, and what each one can reach

The role list grew with real client requirements rather than being designed in the abstract: customer, staff and admin at the base, then developer, then business and business-pending for trade accounts, then client admin, head office admin, head office staff and franchise admin, then supplier and catalogue manager.

Application code separates global roles from branch-scoped roles. Head office roles operate across all branches; franchise admin and branch staff are branch-scoped and their queries are constrained to their own branch. On login, a branch-scoped user lands on their own branch view while head office lands on a global dashboard.

The database enforces the boundary

Policies on inventory, orders and order lines are written using security-definer helper functions that answer two questions: does this user hold this role, and is this user staff at this branch. Those helpers are used inside the policy conditions rather than joins being re-written per table.

The result is that scoping does not depend on a developer remembering to add a filter to a new screen. A missing filter returns fewer rows, not another franchisee's data.

• Role checks and branch-membership checks are reusable database functions
• The same pattern governs inventory, orders, pricing tiers and variants
• New admin screens inherit the boundary automatically

What branch scoping feels like in practice

Stock import is the clearest example. A head office user maps a spreadsheet's store column across many branches. A franchise-only user does not see the store column at all, the import is forced to their single assigned branch, and the mapping step disappears.

That is the correct behaviour for a franchise tool: fewer decisions for the franchisee, no possibility of importing into the wrong store, and no training required to explain which store code is theirs.

One platform, many storefronts

Because pricing overrides, stock and promotions are branch-scoped, one deployment can present branch-specific storefronts that inherit head-office rules. Central creative and catalogue, local price and stock reality.

It is worth being precise about the model: a franchise is a role-and-permission concept layered on branch records, not a separate hierarchy table. In practice that keeps reporting simple, because every number rolls up through branches.