--- title: "Nine roles, one system: who can see and do what | GoSufra" description: "How role-based permissions work in practice, why a branch manager should not see another branch, and what an audit trail is actually for when something goes missing." url: "https://gosufra.com/en/blog/roles-and-permissions/" language: "en" source: "https://gosufra.com" --- # Nine roles, one system: who can see and do what How role-based permissions work in practice, why a branch manager should not see another branch, and what an audit trail is actually for when something goes missing. 2026-08-25 · 7 min read ![Illustration of a key beside a tree of permissions](https://gosufra.com/blog/roles-and-permissions.svg) ## Key points - Permissions are not about distrust. They are about not asking a cashier to ignore your margins. - A branch manager is scoped to their branch by the system, not by an instruction. - Every sensitive action is logged with who, what and when — before you need it. - Shared logins destroy accountability. One person, one account, always. The first time an owner hands a tablet to a new starter, they usually ask the same question: what can this person see? It is the right question, and the honest answer has to be specific. ## Nine roles, and what each one is for | Role | Exists to | | --- | --- | | Admin | Own the account: settings, menu, staff, books, everything | | Branch manager | Run one branch, and see only that branch | | Cashier | Take orders and payment, and close their own shift | | Waiter | Work the floor and the tables assigned to them | | Kitchen staff | See what to cook and mark it done | | Driver | See assigned deliveries and their addresses | | Accountant | Read the books and the reports, not change the menu | | Customer | See their own orders, points and addresses | | Platform operator | Maintain the platform itself, never one restaurant’s day-to-day | The point is not that people are untrustworthy. It is that a screen full of things you cannot act on is a screen you learn to ignore — and a cashier who is shown your food-cost margin has been given a distraction, not a tool. ## Branch scoping is enforced, not requested The most common failure in multi-branch operations is a manager who can see the whole chain because nobody restricted the query. Telling someone “only look at your own branch” is a policy. Preventing it is a system. A branch manager’s requests are checked against their own branch id — in the route, in the query string and in the body of what they submit. If they ask for another branch’s numbers, the answer is no, regardless of which screen they found the button on. ## What the audit trail is for Two records run alongside every action: - **The activity log** — a readable list of what staff did: this cashier voided that item, this manager approved that refund, at this time. - **The audit trail** — the underlying record of what changed, including the before and after values, the user, and the request that carried it. Neither is interesting until the day a number is wrong. Then they are the difference between a conversation about facts and a conversation about memories. This is also why a posted accounting entry is reversed rather than edited: an editable history cannot answer questions. ## The rules that make it hold Three habits do more than any permission matrix: 1. **One person, one account.** A shared “cashier1” login means every void, refund and discount belongs to nobody. If you take one thing from this article, take this one. 2. **Approval on the actions that move money.** Voids, refunds and discounts above a threshold should need a manager. Not because staff steal — because a required second pair of eyes catches the honest mistakes too. 3. **Remove access the day someone leaves.** Offboarding is not just returning a uniform. ## What protects the account itself Under the roles sit the ordinary defences: passwords are hashed, five failed sign-in attempts lock an account for a cooling-off period, sessions can be revoked device by device, and long-lived tokens rotate rather than living forever. Sensitive endpoints are rate-limited so a script cannot grind away at a login page. None of that is visible on a normal day, which is exactly what you want from it. ## A sensible starting configuration For a single site: one Admin (you), one Cashier account per cashier, one Kitchen account per screen — and, if you have an accountant, an Accountant login so they stop asking you for exports. For a chain: add a Branch manager per site, and resist the temptation to make a second Admin “for convenience.” Convenience is how a chain ends up with four people who can change prices and no way to know which one did. - role based permissions - restaurant staff access - audit trail - restaurant security ## In the product ### [Analytics, Branches & Control](https://gosufra.com/en/features/analytics-and-reports/) Explore ### [HR & Workforce](https://gosufra.com/en/features/hr-and-scheduling/) Explore ## Run all of this from one system POS, kitchen, inventory, recipe costing, staff and accounting — connected, and free to start. [Create your free account](https://app.gosufra.com/register?lang=en) ## Related articles ![Illustration of six tiles wired back to one hub](https://gosufra.com/blog/six-connected-apps.svg) How it works 2026-08-31 · 7 min read ### [The six apps, explained: who gets which screen and why](https://gosufra.com/en/blog/six-connected-apps/) Manager dashboard, POS, kitchen display, waiter, driver and customer app — what each one is for, who logs into it, and how one order moves through all six. Read article ![Illustration of a shield over a stack of backed-up records](https://gosufra.com/blog/data-security-backups-and-ownership.svg) How it works 2026-08-13 · 8 min read ### [Who owns your restaurant's data, and what actually protects it](https://gosufra.com/en/blog/data-security-backups-and-ownership/) How one restaurant's data is kept separate from another's, what an audit trail proves, how to get your data out, and the questions worth asking any vendor before you sign. Read article ![Illustration of a cash drawer beside a variance figure](https://gosufra.com/blog/cash-shifts-and-reconciliation.svg) Operations 2026-08-17 · 7 min read ### [Cashier shifts and the day-end count: making the drawer explain itself](https://gosufra.com/en/blog/cash-shifts-and-reconciliation/) How opening float, cash in, cash out and refunds produce an expected drawer, what a variance actually tells you, and why a close that always balances is the one to worry about. Read article [← All articles](https://gosufra.com/en/blog/) [Contact us](https://t.me/GoSufraSupport)