The definition of access rights to an employee can be set up in 3 different ways, whether or not combined:
The definition is being set up for each employee in the screen employee, under the tabs Access Profiles, Personal Access Profiles and Access exceptions.