Roles, permissions and till restrictions

A role defines which sections an employee can see, edit or configure, which locations they cover, and which till operations they can perform without approval.

The role is assigned to an employee in their card. Waiter, Cashier, Manager and the others are built-in roles (some interface labels call them positions); you can adjust them. Create a custom role from scratch or by duplicating a built-in one; a role is not assigned to a till.

Requirements#

• Sign in as the account owner.
• Open Staff → Roles & access.
• Create the locations the employee will use.
• For till work, set a PIN and assign the role to the employee.

Only the owner edits roles and the Manager and locations block. A manager keeps their operational level but cannot grant roles or appoint managers.

Create or configure a role#

1. Open Staff → Roles & access.
2. Click Create role for an empty role, or Duplicate to copy another one.
3. Click Configure beside a preset.
4. Name the role and select its sections.
5. Set access levels, locations and till limits. If the person runs the schedule and timesheet and decides time-off and shift swaps, tick Shift manager rights — the server checks this permission.
6. Click Save.

Built-in roles can be overridden and later restored with Reset to default. A custom role can be hidden; delete it only after moving its employees to another role. Changes apply at the employee’s next sign-in.

Three access levels#

Enabling Edit or Setup also enables View. Removing View removes the section.

The levels apply, for example, in Menu, Orders, Inventory, Staff, Customers, Appointments, Tables, POS, Finance and Settings. Similar checks are used by selected calls, school, housekeeping and telephony screens. Other sections currently open or close as a whole. In Settings, personal tabs remain when Setup is off.

There is no universal server-side check of these levels for all operations yet. View-only mode does not guarantee that every change outside these screens is blocked.

Sections and locations#

Under Sections available to the role, select only what the employee needs. Other sections remain unavailable even through a direct link.

Under Locations, choose All locations or Selected locations. Employee location coverage is separate from the role. New employees in an account with two or more locations must have a location; old empty records may still cover all locations, so fill them in from the notice on the staff list. Role and employee locations intersect; All locations in a role does not remove the employee’s own restriction.

Task: a sales assistant covers colleagues in Moscow and Kazan. Include both locations in the role and employee card, then ask them to sign in again. Result: work at both locations; if one is unavailable, check the intersection of the lists.

Report tabs and the role dashboard#

A role does not have to get Finance or Statistics as a whole. Below the section list the role editor shows a Report tabs block for the report sections the role can view.

1. Open Staff → Roles & access and click Configure next to the role.
2. Turn on View for Finance (or Statistics).
3. In Report tabs, untick the tabs the role does not need, for example Expenses & P&L and Staff (labour cost).
4. In Default dashboard, choose the chart set the role starts Dashboard with.
5. Click Save and ask the role's employees to sign in again.

Task: a cashier needs sales but not profit or labour cost. Give the Cashier role Finance with the Overview and Sales tabs. The employee sees two tabs and the line “🔒 6 tab(s) hidden by your role permissions”; the address of a hidden tab opens the first allowed one, and the page does not load the hidden tab's data.

Task: a new manager needs their own chart set right away. Create a Manager tab on Dashboard, then select it in the Manager role under Default dashboard. A link to a specific dashboard wins over this setting; if the dashboard was deleted, the first one opens.

Hiding tabs works in the admin app. The account's finance database is one file, so an employee with Finance can technically download all of it; there is no server-side split by tab yet. If P&L data must never be shown, do not give the role Finance.

Compare two roles#

1. On Roles & access, click Compare roles.
2. Choose Role A and Role B.
3. Rows that differ are highlighted; Differences only hides identical rows.

The comparison covers sections with levels (view, edit, settings), report tabs, till permissions and the discount limit, locations, the server tier, Shift manager, the start workspace and the default dashboard. The window keeps the pair in the address, so you can send the link to a colleague.

Task: a cashier at one location can refund and a cashier at another cannot. Compare the two cashier roles: the Cash register group highlights the refund and void row or the difference in locations.

Create an employee like another#

When a new location opens and you need several identical employees:

1. On the Employees tab, find the template employee and click 👥 Create like this employee.
2. The create window opens with the same role, sign-in mode, locations and pay.
3. Enter the new employee's name, email and password and click Create.

Personal data, notes, PIN, schedule and documents are not copied. Template locations that no longer exist are dropped — choose the location again.

Employee access report#

For a quarterly access review or after dismissals, click Employee access report (CSV) on Roles & access. For each person the file lists:

Rows that need attention come first. Last sign-in has been recorded since 28 Oct 2026, at most once an hour; people who have not signed in since then show “no data”. Only the owner can download the file; employees see only their own role.

Manager and deputy#

In the employee card, open Manager and locations. Select an employee with sign-in access under Direct manager.

Requests go to the manager first, then to the owner if the manager does not decide in time. The manager handles requests and schedules for direct reports; documents, rates and payroll remain with the owner.

Under Deputy for a period, click Add deputy, choose a person and set From and To dates. During that period the deputy decides the manager’s requests. Nothing else is delegated. Assigning a direct manager does not narrow an existing manager tier; review that person’s role separately. There is no screen for individual exceptions to a role; create a separate role or adjust locations and delegation.

Till permissions#

Under Cash register limits, configure Discount without approval, %, Refunds and voids without approval, Refund without a receipt, Receipt reprint needs a manager PIN, approval of another operator’s transaction with the employee’s PIN, and Floor panel on POS.

When a refund, void or discount exceeds the cashier’s role limit, the till opens senior approval. The cashier chooses an approver; the senior enters their PIN. Approval is available to the owner or an active employee with Can approve others’ operations by PIN at that location. An employee cannot approve their own request; when the till uses the approver’s account, their PIN is required.

Online payments: statuses and refunds without keys#

To let a manager refund a guest’s online payment without the owner, or let an accountant see whether payments are connected at each location, give the role the Online payments: statuses and refunds right in the section list. The right is granted only explicitly and applies at the role’s and employee’s locations.

• View — the location Payments block shows connected providers and the test or live mode, without keys or their masks. There are no Connect and Disconnect buttons.
• Edit — also refund, cancel or capture an online payment: from Returns and from the payment review in Orders, if those sections are open to the role too. The role also needs Refunds and voids without approval.
• Online payment refund cap (location currency) appears under Cash register limits once the right is selected. The server rejects a single refund above the cap and no money moves. Leave it empty for no cap.

Connecting and disconnecting providers, keys, booking deposits and school refunds stay with the owner. Every refund, cancellation and capture is written to Staff → Action log, area Online payments, with the employee, location and amount.

Approval from a phone#

It works only in the web POS: Android and Windows tills still require a senior PIN. The manager needs an open admin tab; there is no separate staff push notification.

In the operation window, click Ask a manager. The cashier may add Note for the manager (optional) and click Send request. The till then shows Waiting for the manager and The request is visible to the location managers. You can call them or a manager can enter a PIN here.

The manager opens Register asks for approval in admin on their phone or computer; there is no need to share a PIN. They see who asked, what needs approval, the total and the bill lines, then click Approve or Decline. The till applies the approved operation; the manager sees Approved — the cashier sees it right away. If the bill changed, the request shows The bill changed after the request. It cannot be approved — ask the cashier to send it again, or open the bill and do it yourself.

The waiting screen offers Call a manager and Call. Calls work from the browser phone enabled in My extension.

Location settings#

Open the POS settings for the location and find Enforce discount limits on the server. It covers a ticket or item discount and a price reduction above the employee’s role limit: without a manager PIN it is not applied, even when sent by an old app or another client. When disabled, the till checks the limit locally.

The location also has Manager PIN to void a sent item. An employee whose role cannot cancel an item already sent to the kitchen must enter a senior PIN. The owner and a role allowed to cancel are not asked; Clear ticket always asks when the role lacks that permission. The location setting works together with the employee’s basic role permission.

Who changes the menu, prices and stop list#

Task: a sales assistant reads the catalogue, while a manager changes the assortment and prices.

1. In Roles & access, open the sales assistant’s role: keep View for Menu, turn off Edit and unnecessary Setup access.
2. Give the manager Edit in the required section and check location coverage.
3. If a partner with their own account edits prices, open Share for the location and grant Prices (the price-editing permission). Menu grants menu editing.
4. Ask employees to sign in again and check their available actions at the location.

Result: the role separates catalogue viewing from editing, while co-ownership provides a separate location price-editing level.

Prices only, stop list only or descriptions only#

If an employee should change only part of an item, open the role and clear what they don't need under “What the role can change in an item”. The block appears when the role has Edit in Menu or Catalog.

The server performs the check, so the limit applies in the admin panel, at the till and in other apps. For example, a manager with Prices but without Content can change a price, while an attempt to change the name is rejected and the item stays as it was.

What changes once at least one box is cleared:

• Menu opens as view-only. The pencil next to an item opens a short window with the allowed fields; forbidden fields aren't shown in it.
• The role can't add, delete, move, import or archive items.
• Photos and recipes can't be edited in the short window. They need a role with all three boxes ticked.
• Other catalogue sections become view-only for this role: collections, features, labels, print and similar.
• Only a role with Content can add an item to a location or remove it from one, because that changes the location's menu rather than a price.
• Location prices and the stop list change only at locations where the employee works.

New rights apply when the employee signs in again, and within 30 minutes at the latest.

For the POS stop list, also check Floor panel on POS: access to this window depends on till permissions, not just Menu Edit. The Availability box permits writing the stop itself. Choose a local stop for the required location; the all-locations action changes availability across the chain.

Protection against PIN guessing#

A successful check outside the lockout resets the counter. These rules are different from an incorrect account password. If an unknown person may know the code, waiting is not enough: revoke it and issue another.

The owner reviews role and access changes in Staff → Action log. Find till refunds, discounts and voids in Statistics → Risk operations: select the location, period and cashier.

Limitations#

Individual role overrides are unavailable. Use a separate role, selected locations, or manager/deputy delegation.

Troubleshooting#

FAQ#

Can a manager create a role?#

Role configuration is owner-only. A manager’s operational permissions do not grant global delegation powers.

Can I add one extra button for one employee?#

There is no general individual override. Create a separate role or adjust locations and delegation.

Why does Edit not protect every action?#

The level is enforced on the page; one server-side check for every action is not complete yet.

How do I find out why two employees have different access?#

Open Roles & access → Compare roles and pick their roles. If the role is the same, compare the locations in the employee cards: access is the intersection of role and card locations.

What does a deputy receive?#

Only the manager’s requests during the selected dates. Documents, rates, payroll and other sections remain unchanged.

Who sees employee pay rates and notes?#

The owner, the employee (their own rate only) and anyone granted the pay-rate or personal-data permission see the rate. Card notes are visible only to the owner and holders of the personal-data permission. A shift manager sees the people list, schedule and job titles but not other people’s rates, so Labor cost shows no amounts for them. Other employees see only colleagues’ names and job titles.

Why did a till permission not change immediately?#

Role changes apply at the employee’s next sign-in.

Related sections#

• Staff — employee cards, locations and lifecycle.
• POS — cashier work and approvals.
• Hall panel — hall operations.
• Orders — orders and location coverage.
• Security and data — logs and change history.
• Chain management — access to several locations.
• Discounts, promo codes and points at the till — how a cashier applies a discount and asks for approval.
• Shift schedule — what a shift manager runs.
• Timesheet — clock events and hour approval.
• Sales commission and bonuses — pay and the employee payslip.
• Staff notifications — who gets order and call alerts.