Each Tenant should contain a folder called Business Structure (for single-tenant Configuration Servers, the Business Structure folder must be created under Resources). Under that folder there can be multiple levels (nodes) of sites/business units that represent the business hierarchy for this Tenant.
Each user login should be configured in Configuration Server with Read permissions for only the Tenants that will be visible to this user (if there is more than one Tenant) and Read permissions for only the nodes of the business hierarchy that this user can view. Users who have Rule View permissions can see all of the rules that are associated with a node that is visible to them. See About Business Structures for more information about business structures.