Flat RBAC can't model regions, divisions, departments, and teams. Canopy's hierarchical access control scopes permissions to exactly where they apply: a regional manager sees their region, a team lead sees their team, and a global admin sees everything.
Define node types (region, office, department, team) and parent-child rules. Canopy enforces your schema, you can't accidentally put a team under a team if your schema doesn't allow it.
Users see only the parts of the hierarchy they have access to. A regional manager sees their region and everything below it, but nothing outside. This isn't filtering. It's enforced at the API level.
Grant temporary access with effective_from and effective_to dates. Contractor access that auto-expires, planned promotions that activate on a future date, no manual cleanup.
Build and manage your organizational tree through the dashboard. Create nodes, drag to reorder, assign identities, operators can manage the full structure without writing code.