Settings

Create, Clone and Edit Role Permission Matrices

Roles are reusable permission groups. Edit a role carefully because assigned users inherit the updated access immediately.

Menu path: Manage -> Employees -> Roles
Verified from: Posnic demo and current POS source reviewed on 2026-09-08

Technical source evidence

Live local Posnic app reviewed 2026-09-09, frontend/modules/roles_admin.html role list and editor, frontend/static/script/js/modules/js/roles.js MODULES, POS_KEYS, openEditor, save, remove, api/src/constants/roles.constants.js DEFAULT_ROLES, ROLE_POS and ROLE_MGR_APPROVAL, api/src/repositories/role.repository.js recomputeUsersForRole and deleteRole safeguards, api/src/controllers/roles.controller.js user permission gating, api/src/controllers/sales.controller.js void and refund enforcement

Current Posnic Roles list showing eight system roles with descriptions and till authority counts — **Roles list**The current tenant starts with eight system roles. Till Authority summarizes actions each role can perform alone and actions needing a manager.

Current Posnic Cashier POS Operator role detail showing allowed till actions and seven actions needing a manager — **Cashier role detail**Open a role before editing to review its description, direct authority and manager-assisted actions.

Current Posnic Cashier role editor showing module Read Write and Delete permission matrix — **Module access matrix**Module rights control which business areas the role can read, change or delete.

Current Posnic Cashier role editor showing Allowed and Needs Manager Approval columns for till actions — **Till-action policy**Allowed means the role may perform the action alone; Needs Manager Approval marks the intended elevation path.

Current Posnic Cashier role editor showing register, cash, quick sale permissions and discount and refund limits — **Register actions and limits**The lower editor includes register open and close, cash movement, cash drop, quick sale, maximum discount and maximum refund controls.

Open and Review Roles

Open Manage -> Employees.
Select the Roles tab.
Read the role list before editing: Role, Type, Description and Till Authority.
Click a role row to open the detail pane.
Check Till authority and Needs a manager before changing anything.
Use Clone when a system role is close but not exactly right for your shop.
Use Edit only after the owner approves the policy change.

System and Custom Roles

Role type	What you can do	Important rule
System	Tune permissions and POS authority.	System roles cannot be deleted.
Custom	Create, edit, clone and delete when unassigned.	A role assigned to users cannot be deleted until users are reassigned.
Assigned role	Controls all users holding it.	An edit recomputes assigned users immediately.
Unassigned role	Can be tested or retired.	Delete only after confirming it is not used in training or integrations.

Built-In Roles in the Current App

The reviewed tenant displayed eight system roles. Treat these as starting policies, then inspect their exact permissions because a system role can be tuned for the tenant.

Built-in role	Intended use	Operator check
Owner	Full business ownership and staff administration.	Reserve for the business owner.
Admin	Full operational administration.	Review staff and settings access before assignment.
Store Manager	Store operations, reports, financials and staff oversight.	Confirm branch scope and approval credentials.
Shift Supervisor	Cashier duties plus broader till and register authority.	Test opening, closing and approvals on a training shift.
Cashier / POS Operator	Sales and customer work with restricted sensitive actions.	Current default shows 2 direct till actions and 7 manager-assisted actions.
Inventory Clerk	Items, stock and purchases without normal POS authority.	Verify receiving access and absence of sales authority.
Accountant	Reports and financial review without POS operations.	Keep operational write permissions off unless deliberately required.
API / Integration	Programmatic integration access.	Grant only scopes needed by the integration and protect its credentials.

Module Access Matrix

Module access is the screen and record layer. Read lets the user view data; Write lets the user create or change records; Delete lets the user remove records where that module supports deletion.

Module	Typical owner rule	High-risk access
Dashboard	Most staff can see basic dashboard tiles.	Dashboard financials should be management/accounting only.
Sales	Cashiers need read and write to sell.	Delete, void and sale correction should be supervisor-controlled.
Receiving	Inventory or purchase staff only.	Write and delete affect stock and supplier evidence.
Customer	Cashiers may need read/write for account customers.	Delete affects account history and credit follow-up.
Supplier	Purchase staff only.	Write/delete affects purchase source records.
Category and Item	Inventory staff can maintain catalog.	Delete can break item history and scanner setup.
Expense	Cash Book or accounting staff only.	Write/delete moves non-sale money evidence.
Branch	Owner or store manager.	Branch changes affect receipt identity and access.
Report	Owner, manager or accountant.	Financial and staff performance data may be sensitive.
User	Owner or trusted manager.	Controls staff accounts, roles, PINs and API users.

POS Actions and Manager Approval

POS actions are the till authority layer. A cashier can have Sales write permission but still need manager approval for refunds, price overrides or register close.

POS action	Use carefully because	Recommended default
Apply discount	Reduces margin and can hide pricing mistakes.	Cashier needs manager approval or a low cap.
Price override	Changes item price at the counter.	Manager approval.
Void a line	Removes a line from the bill.	Supervisor or manager approval.
Void a sale	Cancels an entire sale.	Manager approval.
Refund / return	Creates money and stock movement.	Manager approval and original bill review.
Reprint receipt	Can expose customer and payment evidence.	Usually allowed for cashier.
No-sale open drawer	Opens cash drawer without a sale.	Manager or supervisor only.
Open register	Starts the cash session.	Supervisor or trusted cashier.
Close register	Ends drawer accountability.	Supervisor or manager only.
Cash in / out and Cash drop	Moves cash outside normal sale payment.	Supervisor or manager only.
Quick sale / instant items	Allows amount-only sale lines.	Allow only if Quick Sale is part of shop policy.

Current Enforcement Boundary

Do not treat every visible till-action checkbox as a complete security boundary yet. The current editor explicitly states that Void sale and Refund / return are enforced server-side today; the other action gates take effect as they ship.

Control	Current status	How to operate safely
Void sale	Server-side permission enforcement is present.	Still test with the assigned employee and verify denied and approved paths.
Refund / return	Server-side permission enforcement is present, including refund policy checks.	Use original-sale review and test refund limits before rollout.
Other till-action switches	Visible and stored as role policy; full runtime enforcement is not promised by the current UI.	Use them as configured policy, but retain supervision and test the exact action after every release.
Module Read / Write / Delete	Used by controllers and screens for module access.	Verify with a non-admin employee because admin-class accounts can bypass ordinary checks.
Manager approval	PIN/card elevation exists for supported restricted actions and records approval evidence.	Configure an eligible manager credential and test the prompt; never share a manager login or PIN.

Save and Test a Role

Name the role for the job, not for a person.
Write a short Description so another manager understands the policy later.
Set module Read, Write and Delete checkboxes.
Tick Dashboard financials only for roles allowed to see profit, margin, cost, expenses, cash and dues.
Set POS action Allowed checkboxes for actions the role may do alone.
Set Needs Manager Approval for actions a cashier can request but cannot approve alone.
Set Max discount % and Max refund amount when the role should have a numeric limit.
Save the role.
Assign it to a non-admin test employee; admin-class accounts can bypass ordinary permission checks.
Sign out of the owner account and sign in as that employee on the intended branch and device.
Verify one allowed action succeeds, one denied module is absent or rejected, and each sensitive till action behaves as configured.
Test both manager-approved and rejected Void sale and Refund / return paths.
Record the test result and repeat it after a Posnic upgrade changes permission behavior.

Role Troubleshooting

Problem	Likely reason	Resolution
Employee still has old access	The session or browser still holds earlier user context.	Sign the employee out and back in, then retest. Role updates recompute assigned users immediately in storage.
Role cannot be deleted	It is a system role or still assigned to an employee.	Clone or edit a system role; reassign all users before deleting a custom role.
Manager prompt cannot approve	No eligible manager PIN/card exists, or the approver lacks that action.	Configure the manager credential and confirm the manager role is allowed to perform the action.
Checkbox is set but action is not gated	The granular action is outside the currently enforced server-side pair.	Treat the setting as policy and supervise the workflow until the release explicitly adds enforcement.
User sees financial totals	Dashboard financials or a broad management role is assigned.	Remove financial visibility, save, sign the user out and retest.
User sees only their session sales	Sales Session Filter is enabled on the employee access record.	Disable it only when the job requires wider sales history.