How do you control which employees a user can access in Keystone, including KeyNet?

This is managed in a subscreen of the Validation File Maintenance screen (KF0045) (General System Administration-> Security/Menus/Access Rights).  These access rights apply to all areas of Keystone, including KeyNet.

Once you have pulled up a user whose access rights you want to adjust, select the Employee Access button (KE9005).

Note: You will need to make sure that this person’s own employee number is filled in at the top of this screen.

You can then select from these options related to employee access:

1. All access 
2. When building matches – restrict access to employees in your building
3. When department matches – restrict access to employees in your department
4. Employees Supervised – restrict access to employees that have you as their Supervisor
5. Requisition Approval Group (Dept) – restrict access to employees in your Requisition Approval Group (Dept)
6. No access

In addition to these options, you may add other buildings or departments.  You can also override (disable) security on specific screens in Keystone Client.