Staff Roles & Cashier Permissions: Give Every Employee Exactly the Access They Need

Too many permissions slow nobody down — too few create bottlenecks at the worst moment. The goal is simple: every employee gets exactly the access their job needs, and nothing more.

Start with three core roles

• Cashiers ring sales, apply approved discounts, and process returns within a manager-set limit.
• Managers override limits, void transactions, adjust inventory counts, and close the day.
• Admins manage locations, tax tables, integrations, and API keys — the keys to the kingdom.

Separate people from API keys

• Staff logins belong to humans and should follow the person, not the device — reassign the lane, keep the identity.
• Machine access goes through scoped API keys with the minimum endpoints each integration needs.
• Rotate keys when staff in technical roles leave, the same day they leave.

Make overrides painless but visible

1. Let managers approve voids and large discounts with a quick PIN or approval step at the counter.
2. Log every override with who, what, and when — visible in the day's reconciliation.
3. Review the override log weekly; patterns reveal training gaps or policy problems.
4. Keep the audit trail exportable so accountants and owners can verify independently.

Use Swagger UI or OpenAPI for the current staff, role, and permission request shapes.