How does department scoping work for staff users?

[scottconverse]

Department scoping is enforced at the API layer. Staff with a department assignment can only access their department records -- even via direct API calls. Admins see everything. Setup: Admin -> Departments to create departments, then assign users and sources to departments.