Roles and permissions

Every member of staff has one role. The role decides which pages appear in their menu and which actions they can take. TillPoint checks the same rights behind the scenes, so hiding a page is not the only protection.

You assign roles on the Users and roles page. An owner or admin can also give one person a custom set of rights that differs from their role.

The built-in roles

The role code is what appears on the staff list. Your business may have renamed a role, but the code stays the same.

Role	Code	In plain words
Owner	OWNER	Can do everything, including payroll.
Admin	ADMIN	Runs the whole business day to day: selling, money, stock, purchasing, staff, terminals, settings, integrations and the audit trail. No payroll.
Manager	MANAGER	Runs a branch: selling, refunds and voids, payments and reconciliation, reports, stock, purchasing, expenses, staff below admin level, terminals and restaurant settings. No integrations, audit trail or payroll.
Supervisor	SUPERVISOR	Runs the floor: sells, takes payment, sees the team’s orders, uses Counter Hub and Kitchen orders, and approves order changes for waiters.
Cashier	CASHIER	Takes payment in Counter Hub and Checkout, prints bills and paid receipts, sees sales on their register, and adds or edits customers.
Waiter	WAITER	Takes orders for their own tables and tabs, sends them to the kitchen and prints the unpaid bill. Cannot take payment.
Kitchen	KITCHEN	Sees prepared-item tickets in Kitchen orders, starts them and marks them ready. Nothing else.
Inventory	INVENTORY	Looks after the catalogue and stock: edits products, sees costs, adjusts inventory, raises and approves purchase orders, receives and confirms deliveries, and proposes and approves buying prices.
Storekeeper	STOREKEEPER	The same stock and purchasing work as Inventory, but cannot edit the catalogue.
Procurement	PROCUREMENT	Buys: raises, imports and approves purchase orders, proposes buying prices, and sees the catalogue with costs, stock levels and reports. Does not receive deliveries.
Accountant	ACCOUNTANT	Sees branch sales and reports, reconciles payments, sees purchasing and buying prices, and records operating expenses.
Auditor	AUDITOR	Read-only oversight: branch sales, payment reconciliation, reports and the audit trail.
Payroll officer	PAYROLL_OFFICER	Prepares payroll and sees the staff list and reports. Cannot approve or pay a payroll run.

Only the owner, admin, manager and payroll officer roles can use management sign-in with an email and password. Everyone else, including accountants and auditors, unlocks a shared terminal with their staff PIN.

Things worth knowing

• Waiters stop at the bill. A waiter can print the unpaid bill but not take payment. A cashier, supervisor or manager settles it in Counter Hub.
• Cashiers see their own register only. Branch-wide sales, reports, reconciliation and stock costs need other roles.
• Costs stay hidden from selling roles. Supervisors, cashiers and waiters do not see product or stock costs.
• Payroll is separate. No role except Owner can approve or pay payroll by default. Payroll rights have to be given on purpose. See Payroll.
• Managers cannot manage admins. A manager can add and edit staff below admin level. Only an owner can create or edit an Owner or Admin account.
• Nobody changes their own role. You cannot change the role of the account you are using, or delete it.

Manager PIN approvals

Some actions need a second person. When you do not have the right yourself, TillPoint asks for an approver’s PIN. The field is usually labelled Authorised manager PIN or Manager PIN if your role requires approval.

The approver types their own PIN on your screen. The approval is recorded with both names: yours as the person doing the action, and theirs as the approver.

The approver must:

• be a different person from you
• have an active account whose PIN is not blocked
• hold the Owner, Admin, Manager or Supervisor role
• have the right for that action themselves

Actions only a manager can approve

These actions need an Owner, Admin or Manager. A supervisor cannot approve them, and a supervisor who does them also needs a manager’s PIN:

• refunds and voids
• discount overrides
• closing a shift that needs approval
• reopening a bill
• approving an M-Pesa payment exception
• approving bottle and keg wastage
• reversing a confirmed goods receipt

Owners, admins and managers who hold the right for one of these can do it without a second PIN.

Actions a supervisor can approve

A supervisor with the right can approve, for example, moving an order to another waiter, splitting or merging bills, and removing items from or clearing an order that has not been sent.

Wrong approval PINs

After a few wrong approval PINs, TillPoint pauses further attempts for a while. The pause grows with each wrong attempt, up to 15 minutes. Every approval and every pause is recorded in the audit trail.

Changing what a role can do

On the Users & roles page, the Role bundles panel lists every role, how many staff have it, and whether it is Built-in or Custom. Owners and admins can:

• Edit a role’s name and rights
• Duplicate a role to start a new one from its rights
• Create role from scratch, with a Role name and a permanent Role code
• Delete a custom role that no staff account, active or past, has ever used

The Owner role cannot be edited. Only an owner can edit the Admin role. An admin can only include rights they hold themselves, and some rights, such as managing roles, managing integrations and paying payroll, can only be given by an owner.

Changes to a role apply straight away to everyone who follows that role, unless they have custom rights. Staff should lock and unlock the terminal, or sign in again, so their menu catches up.

To give one person different rights from their role, see Individual rights.