If the user or the location and org unit pair is associated with a certain group scope, then the user can see only those resources that are allowed for the user. You can associate the location and org unit pair to a group scope on the Authorization > Group Scope page in System Admin. You can associate the user to a group scope on the Authorization > User Authorization page in System Admin.