# Multi-branch business software: deciding who can view and edit records

Source: https://pixelsaa.com/en/blog/multi-branch-software-permissions
Language: en
Published: 2026-11-06T02:12:02+00:00
Updated: 2026-11-06T02:12:02+00:00

## Designing Multi-Branch Systems

When a company has multiple branches, the technical challenge is balancing centralization with autonomy. The headquarters manager needs a comprehensive view, while a branch manager needs to focus only on their specific branch's data. Simply hiding buttons in the user interface (UI) is not enough; permission checks must occur on the server side every time data is requested, ensuring a user from Branch A cannot access data from Branch B.

## Data Scope and Permissions

The database structure should be designed so that every record (such as sales or inventory) is linked to a branch ID. Upon login, the user's 'scope' is determined, preventing them from seeing anything outside their permissions. This scope extends to search operations and reports. You must also consider 'employee transfers' between branches, where the system needs flexibility to update user permissions without losing their previous work history.

## Cross-Branch Workflows

Sometimes, operations require collaboration between branches, such as transferring stock from one to another. This requires an automated workflow that ensures the documentation of the stock leaving the first branch and entering the second, with an audit log showing who approved the operation. This type of workflow reduces the risk of data manipulation.

## Observable Acceptance Criteria

Verify the following:

- Unauthorized access attempts via direct links fail.

- HQ reports are accurate when a new branch is added.

- An audit log exists for every record modification or data transfer operation.

## Scope and Cost Drivers

Cost is affected by the number of branches, the complexity of cross-branch workflows, and the level of detail in audit logs. For more planning advice, refer to Related planning guide (https://pixelsaa.com/en/blog/software-project-acceptance-checklist).

## Practical FAQs

Q: How do we prevent employees from seeing other branches' data?
A: This is achieved through 'server-side filtering,' where unauthorized data is never sent to the user's device in the first place.
Q: Can we start with just two branches?
A: Yes, and that is actually the best approach to ensure the success of the permission structure before expanding to the rest of the branches.

To start developing a system that supports your branch expansion, browse Website development services (https://pixelsaa.com/en/services/custom-software) to define the scope of work.

## A practical acceptance example

Suppose an employee transfers between branches. Update permissions and test search, exports and direct record URLs to ensure old-branch data is inaccessible without authorization. Headquarters receives aggregated reports according to its role. Pilot two branches or representative test accounts: hiding a branch in a menu does not demonstrate data isolation.

Discuss your multi-branch system with a developer (https://pixelsaa.com/en/contact?quote=1&service=5)

## Further reading

Laravel authorization (https://laravel.com/docs/12.x/authorization).

Contact: https://pixelsaa.com/en/contact