Can I restrict what a user sees and edits in the admin?
Yes. Roles scope access by site, section, content type, and action, so a user only sees what they need. Changes can require approval before going live, and every edit is logged.
Yes. Access in Core dna is controlled by roles rather than per-person settings, and a role can be scoped narrowly enough that a user only ever sees the part of the platform they work in.
You can restrict on several axes at once:
- By site or location. In a multi-site, franchise, or dealer network, a user can be limited to their own site and nothing else.
- By section. Grant access to specific areas of the admin and hide the rest.
- By content type. Full edit on local promotions, view-only on the shared product catalog, no access to brand templates.
- By action. Being able to see a record is separate from being able to edit, publish, or delete it.
Two controls sit on top of that. Approval gates can require sign-off before a specific change goes live, which is how central teams keep brand and legal copy locked while still letting local editors work. And an audit trail records every change against the user who made it, so an over-broad permission shows up rather than staying silent.
The recommended starting point is least privilege: grant the narrowest role that lets someone do their job, then widen it if they need more. To create the accounts themselves, see adding users and setting up their access.
Related posts
Platform & Architecture
eCommerce Platform Migration: A 47-Point Checklist for 2026
Platform & Architecture
Kentico Alternatives for Multi-Property Operators
Platform & Architecture
Salesforce Commerce Cloud Alternatives: 6 Platforms Enterprises Should Consider Instead
Platform & Architecture
10 Best Enterprise CMS of 2026
Platform & Architecture
Migrating to Drupal 12: What It Really Costs, and the Question Nobody's Asking
Platform & Architecture
Contentstack Alternatives in 2026: What Type of Agentic Experience Matters to You?