Roles

What this is for

A role is a named set of permissions. Every member of staff has exactly one, and it decides every screen and button they see.

Roles are where access control actually happens. Get the set right once and you rarely touch it again.

Editing a role

1. Go to Settings › Roles.
2. Open the role.
3. Tick what it's allowed to do. Permissions are grouped by area — menu, orders, POS, customers, staff, payments, expenses, reports, settings.
4. Save.

The change applies immediately to everyone holding that role. That's the most important thing to know about this screen. Editing "Waiter" to help one person changes it for all of them.

Creating a role

Add a role when a genuinely different job exists — a bar supervisor, a delivery coordinator, a head chef with menu access.

Start from the closest existing role and adjust, rather than from nothing. It's much easier to see what you're removing than to remember everything you need to add.

Don't create a role per person. Three well-drawn roles beat nine that overlap, and nine become impossible to reason about the first time you need to answer "who can void a payment?".

Designing a set of roles

Most restaurants need four or five:

Role	Shape
Administrator / Owner	Everything.
Manager / Branch Head	Day-to-day operations, reports, staff, discounts, refunds. Not billing or company-wide settings.
Waiter / Cashier	POS, orders, tables, customers. No reports, no settings, no refunds.
Chef / Kitchen	Kitchen tickets and order status. Nothing financial.
Accounts	Payments, expenses, vendors, reports. Not the POS.

Adjust for the restaurant you actually run. A small owner-operated place might need two.

The permissions that cost money

Most permissions are harmless. These aren't, and they deserve a deliberate decision rather than a default:

Permission	Why it matters
Add Discount on POS	Direct control over what a bill totals.
Refund Payments	Money leaving after it arrived.
Delete Item After KOT	Removing food from a bill after it was ordered. The classic route to shrinkage.
Delete Order	Removes the record entirely, not just the order.
Update Menu Item	Prices.
Show Reports	Your margins, your takings, your suppliers.
Manage Settings	Taxes, charges, receipts — the rules everything else runs on.
Approve Cash Register	Signing off that the drawer is right.
Delete Customer	Can take order history with it.

A useful principle: the person who does a thing and the person who checks it should not be the same role. A cashier who can approve their own drawer count is a control that isn't controlling anything.

A method that works

1. List the jobs, not the people. Who works here, in terms of function?
2. For each job, list the screens they need on a normal shift. Not the ones they might want.
3. Give exactly those. Add more when someone is genuinely blocked.
4. Handle exceptions with a manager, not with a broader role. "Ask a manager to apply the discount" is a policy, not a limitation.

Broad roles never get narrower on their own. Narrow roles get widened the moment someone is blocked, and that's the direction you want the pressure running.

Reviewing them

Worth twenty minutes twice a year:

• Does anyone hold a role broader than their job?
• Do any roles exist that nobody holds?
• Did a new feature add permissions nobody has assigned?
• Do the money permissions still sit where you intended?

Good to know

• Superadmin is not a role you manage here. That's the account that administers the platform itself, and it's separate from your restaurant's roles.
• Role changes are immediate. Nobody needs to sign out and back in.
• Some permissions only appear when the matching add-on is on your plan — inventory, hotel, cash register and so on.
• If a role looks right and someone still can't reach a screen, check their branch as well as their role. See Managing staff.

Next

What each role can do