---
title: "Restaurant Staff Roles and Permissions: A Safe Setup"
date: 2026-07-28
updated: 2026-08-29
lang: en
tags: ["hrm", "operations", "guides"]
summary: "A least-privilege access plan for every common restaurant role."
canonical: https://rosuii.com/blog/restaurant-staff-role-permission-guide
author: "Rosuii Team"
---

# Restaurant Staff Roles and Permissions: A Safe Setup

A least-privilege access plan for every common restaurant role.

**Last verified: 2026-08-28**

Shared admin passwords make work feel easy until someone changes pricing, views payroll or deletes data by mistake. Individual logins and job-based permissions create accountability without adding friction.

## Start with least privilege

Give each role only the screens and actions needed for a normal shift. Add exceptional access to a named person instead of opening it to everyone.

- Cashier: POS and orders
- Chef: kitchen queue
- Rider: assigned deliveries
- Manager: approved operational controls

## Protect administrator actions

Only an administrator should create another admin, reset an admin password or change sensitive settings. A user should not deactivate or delete their own account.

## Review access when jobs change

Deactivate departed staff immediately and review roles when someone moves branch or receives a promotion. Permission changes should apply instantly, including to active sessions.

## Build a role matrix from actions, not job titles

List the actions the system can perform: view an order, discount, void, refund, open a cash drawer, change a price, receive stock, approve waste, view salary, export reports, create users and edit settings. Then decide which normal job requires each action. A title such as manager is too broad until the authority and branch scope are written.

Separate view, create, edit, approve, export and delete. A supervisor may need to view a purchase order and confirm receipt without changing supplier or cost history. A cashier may need a controlled discount ceiling without refund authority. This action-level matrix makes least privilege usable rather than theoretical.

## Example restaurant access matrix

This is a starting design, not a universal permission schedule. A restaurant should change it for separation of duties, staffing and policy. Very small teams may combine roles, but the system should still identify the person and log high-risk actions.

Add branch scope to every permission. A user who can view branch A sales should not automatically see branch B payroll. Temporary cross-branch cover needs an expiry date rather than a permanent role expansion.

| Role | Normal access | Keep restricted |
| --- | --- | --- |
| Waiter | Tables, assigned orders, menu | Refund, payroll, settings |
| Cashier | Billing, payment, shift close | User admin, salary, supplier edit |
| Kitchen | KDS/KOT and item status | Prices, customer export, payroll |
| Storekeeper | Stock receipt and counts | Sales refund, salary, admin |
| Rider | Assigned delivery and status | Other riders, reports, settings |
| Branch manager | Approved branch operations | Other branches, owner admin |
| Owner/admin | Governance and high-risk approval | Use daily admin access sparingly |

## Protect high-risk actions with more than a menu toggle

Refunds, voids, discounts, backdated edits, payroll export, payment-detail changes and administrator creation need a reason and visible actor. Depending on risk, require manager approval, a second person, re-authentication or a narrow amount/time condition. The goal is not to slow normal service; it is to make exceptional actions deliberate.

Do not let a user approve their own access change or erase their own audit trail. Preserve the original transaction and create a reversing or correction event where the product supports it. An audit log should answer who, what, when, branch and reason—not simply that a record was updated.

## Control sessions, devices and password recovery

Individual accounts fail when staff share unlocked devices or recovery codes. Name approved counter and kitchen devices, use screen locks, keep administrator credentials off shared terminals and remove remembered sessions after a role or employment change. Recovery should verify the person through a controlled contact, not a group chat.

When access is removed, test whether active sessions and tokens stop working. A password change that leaves a mobile session active is not complete revocation. Record who can reset which role and alert the owner to administrator recovery or a new administrator account.

## Use a joiner, mover and leaver workflow

For a joiner, approve the role, branch and start date before creating access; issue an individual temporary credential and require a change at first use. For a mover, apply an effective-dated role or branch change, then remove permissions no longer needed. For a leaver, disable login, revoke sessions, recover devices and keys and close future assignments at the confirmed time.

One person should request the change and another authorised person should approve high-risk roles. Keep the ticket, form or HR record linked to the access event. Emergency access can exist, but it needs a named owner, reason, expiry and after-the-fact review.

## Quarterly access review procedure

A review is complete only when changes are applied and verified. Keep a short exception list for access that remains wider than the matrix, with an owner and expiry. Avoid certifying a list simply because a manager recognises every name.

- Export active users with role and branch
- Match every account to an active employee or approved service identity
- Review administrators and salary/report exporters first
- Remove unused temporary and cross-branch access
- Check departed staff and duplicate accounts
- Sample refund, void and settings-change logs
- Document the reviewer, decisions and completion date
- Retest revocation on web and mobile sessions

## Permission tests to run in a software trial

- A waiter cannot view another branch or payroll
- A cashier can bill but cannot create an administrator
- A kitchen user sees the queue without customer exports
- A rider sees only assigned deliveries
- A manager's exceptional action records a reason
- A removed user loses active-session access
- An audit export identifies actor, branch and time
- The owner can recover access without a shared password

## Design separation of duties for cash and stock

Where staffing allows, separate the person who creates or changes a record from the person who approves its financial effect. The cashier who receives cash should not silently alter the closed shift; the buyer who creates a purchase order should not be the only person confirming quantity received; the person counting stock should not erase the variance they are explaining.

Small restaurants may not have enough people for perfect separation. Use compensating review instead: owner notification, daily exception report, receipt attachment, threshold approval or next-day review by someone outside the shift. Document the compromise so wide access does not become invisible permanent policy.

Good permissions are almost invisible during work and very visible during an audit. Document the role matrix and review it every quarter.

## Related guides

- [Complete Restaurant HRM Guide](https://rosuii.com/blog/restaurant-hrm-complete-guide)
- [Secure Rider Login Guide](https://rosuii.com/blog/secure-rider-login-delivery-app)
- [How to Manage Restaurant Staff](https://rosuii.com/blog/manage-restaurant-staff)
- [Compare Restaurant Management Software](https://rosuii.com/compare)

**See this workflow in Rosuii:** [See roles and permissions](https://rosuii.com/features#staff-payroll)

[Start using Rosuii for free](https://rosuii.com/register)

## FAQ

### Should restaurant staff share one login?

No. Individual logins improve accountability and let you remove access without disrupting the whole team.

### Can a manager have different access from an owner?

Yes. The owner can retain admin controls while a manager receives only approved operational permissions.

### What is least privilege in a restaurant POS?

It means each person receives only the actions and branch scope needed for normal work, with exceptional access granted narrowly and reviewed.

### Should managers automatically receive administrator access?

No. Give managers the operational approvals they need while keeping user administration, payroll export and sensitive settings separately controlled.

### How quickly should a departed employee lose access?

At the confirmed end time or immediately for an urgent suspension, including active web and mobile sessions, assigned devices and recovery routes.

### What if one employee performs two restaurant roles?

Combine only the required actions for that named person, keep branch scope explicit and review conflicts such as receiving cash while approving the same shift correction. Do not open both entire role profiles without checking the resulting access.

---
Canonical: https://rosuii.com/blog/restaurant-staff-role-permission-guide
Machine-readable site overview: https://rosuii.com/llms.txt