When a user requests the hierarchy, Canopy returns only the nodes at and below their assignment points. Unauthorized nodes aren't filtered out: they're never fetched.
If a user shouldn't see it, it never leaves the server.
Without scoped visibility, your application filters results client-side or builds custom query logic per user. With Canopy, the API returns only what each identity is allowed to see.
Canopy's hierarchy access service determines which nodes an identity can see based on their role assignments: their assignment point, and everything below it.
Promote someone to a higher node and they immediately see more of the tree. Remove an assignment and those nodes disappear from their view. Nothing to recalculate: visibility is derived from assignments, not maintained as a separate copy.
Derived, never duplicated: the server recomputes visibility from assignments on every request. Apps using our SDK's in-process checks pick changes up within its refresh window.
Scoped visibility powers the interfaces you'd otherwise build by hand. Canopy enforces the hierarchy for you.
A company with 50 offices across 5 regions assigns a regional manager at each region node. Each manager sees only their region's offices, teams, and identities. The CEO, assigned at the root, sees everything.