Restaurant Staff Roles and Permissions: A Safe Setup
A least-privilege access plan for every common restaurant role.
Last verified: 2026-08-28
Shared admin passwords make work feel easy until someone changes pricing, views payroll or deletes data by mistake. Individual logins and job-based permissions create accountability without adding friction.
Start with least privilege
Give each role only the screens and actions needed for a normal shift. Add exceptional access to a named person instead of opening it to everyone.
- Cashier: POS and orders
- Chef: kitchen queue
- Rider: assigned deliveries
- Manager: approved operational controls
Protect administrator actions
Only an administrator should create another admin, reset an admin password or change sensitive settings. A user should not deactivate or delete their own account.
Review access when jobs change
Deactivate departed staff immediately and review roles when someone moves branch or receives a promotion. Permission changes should apply instantly, including to active sessions.
Build a role matrix from actions, not job titles
List the actions the system can perform: view an order, discount, void, refund, open a cash drawer, change a price, receive stock, approve waste, view salary, export reports, create users and edit settings. Then decide which normal job requires each action. A title such as manager is too broad until the authority and branch scope are written.
Separate view, create, edit, approve, export and delete. A supervisor may need to view a purchase order and confirm receipt without changing supplier or cost history. A cashier may need a controlled discount ceiling without refund authority. This action-level matrix makes least privilege usable rather than theoretical.
Example restaurant access matrix
This is a starting design, not a universal permission schedule. A restaurant should change it for separation of duties, staffing and policy. Very small teams may combine roles, but the system should still identify the person and log high-risk actions.
Add branch scope to every permission. A user who can view branch A sales should not automatically see branch B payroll. Temporary cross-branch cover needs an expiry date rather than a permanent role expansion.
| Role | Normal access | Keep restricted |
|---|---|---|
| Waiter | Tables, assigned orders, menu | Refund, payroll, settings |
| Cashier | Billing, payment, shift close | User admin, salary, supplier edit |
| Kitchen | KDS/KOT and item status | Prices, customer export, payroll |
| Storekeeper | Stock receipt and counts | Sales refund, salary, admin |
| Rider | Assigned delivery and status | Other riders, reports, settings |
| Branch manager | Approved branch operations | Other branches, owner admin |
| Owner/admin | Governance and high-risk approval | Use daily admin access sparingly |
Protect high-risk actions with more than a menu toggle
Refunds, voids, discounts, backdated edits, payroll export, payment-detail changes and administrator creation need a reason and visible actor. Depending on risk, require manager approval, a second person, re-authentication or a narrow amount/time condition. The goal is not to slow normal service; it is to make exceptional actions deliberate.
Do not let a user approve their own access change or erase their own audit trail. Preserve the original transaction and create a reversing or correction event where the product supports it. An audit log should answer who, what, when, branch and reason—not simply that a record was updated.
Control sessions, devices and password recovery
Individual accounts fail when staff share unlocked devices or recovery codes. Name approved counter and kitchen devices, use screen locks, keep administrator credentials off shared terminals and remove remembered sessions after a role or employment change. Recovery should verify the person through a controlled contact, not a group chat.
When access is removed, test whether active sessions and tokens stop working. A password change that leaves a mobile session active is not complete revocation. Record who can reset which role and alert the owner to administrator recovery or a new administrator account.
Use a joiner, mover and leaver workflow
For a joiner, approve the role, branch and start date before creating access; issue an individual temporary credential and require a change at first use. For a mover, apply an effective-dated role or branch change, then remove permissions no longer needed. For a leaver, disable login, revoke sessions, recover devices and keys and close future assignments at the confirmed time.
One person should request the change and another authorised person should approve high-risk roles. Keep the ticket, form or HR record linked to the access event. Emergency access can exist, but it needs a named owner, reason, expiry and after-the-fact review.
Quarterly access review procedure
A review is complete only when changes are applied and verified. Keep a short exception list for access that remains wider than the matrix, with an owner and expiry. Avoid certifying a list simply because a manager recognises every name.
- Export active users with role and branch
- Match every account to an active employee or approved service identity
- Review administrators and salary/report exporters first
- Remove unused temporary and cross-branch access
- Check departed staff and duplicate accounts
- Sample refund, void and settings-change logs
- Document the reviewer, decisions and completion date
- Retest revocation on web and mobile sessions
Permission tests to run in a software trial
- A waiter cannot view another branch or payroll
- A cashier can bill but cannot create an administrator
- A kitchen user sees the queue without customer exports
- A rider sees only assigned deliveries
- A manager's exceptional action records a reason
- A removed user loses active-session access
- An audit export identifies actor, branch and time
- The owner can recover access without a shared password
Design separation of duties for cash and stock
Where staffing allows, separate the person who creates or changes a record from the person who approves its financial effect. The cashier who receives cash should not silently alter the closed shift; the buyer who creates a purchase order should not be the only person confirming quantity received; the person counting stock should not erase the variance they are explaining.
Small restaurants may not have enough people for perfect separation. Use compensating review instead: owner notification, daily exception report, receipt attachment, threshold approval or next-day review by someone outside the shift. Document the compromise so wide access does not become invisible permanent policy.
Good permissions are almost invisible during work and very visible during an audit. Document the role matrix and review it every quarter.
Related guides
- Complete Restaurant HRM Guide
- Secure Rider Login Guide
- How to Manage Restaurant Staff
- Compare Restaurant Management Software
See this workflow in Rosuii: See roles and permissions
Updated:
Frequently asked questions
Should restaurant staff share one login?
Can a manager have different access from an owner?
What is least privilege in a restaurant POS?
Should managers automatically receive administrator access?
How quickly should a departed employee lose access?
What if one employee performs two restaurant roles?
Run your restaurant on Rosuii
POS, menu, inventory, payroll and more — built for Bangladeshi restaurants.
Start free
