Multi-rooftop data isolation is not a checkbox
If store B cannot see store A data because a screen hides it, they are not isolated. They are one bug away from a very bad afternoon.
Every platform sold to dealer groups says it supports multiple rooftops. Almost none of them mean the same thing by it, and the difference only becomes visible on the day something goes wrong.
Three levels, sold as one
Level one: hidden in the interface
The data is all in one place and the screen filters it. Anyone who can construct a request the interface did not intend can see everything. This is the most common implementation and the weakest.
Level two: filtered in the application
Better. The server checks who you are before returning rows. But every single query has to remember to do it, and the one written at 11pm before a release is the one that forgets.
Level three: enforced at the database
The database itself refuses to return rows belonging to another store, regardless of what the application asks for. A forgotten check produces no data instead of everyone data. That is the only version worth calling isolation.
The test is not whether store B can see store A today. It is what happens the day somebody writes a query that forgets to filter.
Why groups should care more than they do
Two reasons, and the second one is the one that actually bites.
First, the obvious: rooftops in a group often compete, and store managers know it. If a manager believes another store can see their pipeline, they will start keeping things out of the system, and a CRM that people work around is worse than no CRM.
Second, the one nobody plans for: groups buy and sell stores. When a rooftop is divested, the new owner needs that store data and none of yours, and the previous manager needs to lose access cleanly on a specific date. If isolation was a screen filter, that separation is a project. If it was enforced properly, it is an afternoon.
The other half: roles
Isolation between stores is only half the problem. Inside a store, a BDC agent, a finance manager, a service advisor and an owner should not see the same things.
The one worth checking specifically: can your service department be given deliveries and service access without being able to open a lead file? In most systems the honest answer is no, and that is why service staff end up sharing a login.