Walk through the "Real Estate Wonder" example — how do rights plus data scope decide who can act on a given rent contract?

A party may act on a contract only if BOTH its functional right and its data scope match — so two property managers with identical rights are still separated by the region/agency their scope covers.

Imagine "Real Estate Wonder": property managers set up rent contracts, tenants sign them, and operations managers approve them. The business is organised by geographic region, and each agency only sees its own data. Consider Rent Contract #1, created by One Agency in Europe. Its parties are:

• Tenant — David: { right: Tenant, scope: David } — signs.
• Property Manager — { right: Property Manager, scope: Europe/One Agency } — Bob and Grace qualify; they create and update.
• Operations Manager — { right: Operations Manager, scope: Europe } — Eve qualifies; she approves.

Now the key insight: Alice also holds the "Property Manager" right — but her scope is Asia/Premium Agency, not One Agency. So despite having the right, she is denied access to Contract #1 because the scope does not match. Right and scope are ANDed together. This is why onboarding a new Asia operations person needs only granting the "Operations Manager" role plus the "Asia" scope — they instantly get exactly the access their colleague has, and no more.