Roles and permissions

The ten built-in roles, what each can do, and how to fine-tune access.

Team & operations1 min read

#How access is decided

Three layers, applied in order:

Role — a bundle of permissions and app access.
Grants and denials — per-person adjustments on top of the role.
Branch assignment — which locations the person can see at all.

#Built-in roles

Role	Apps	Roughly
`OWNER`	All	Everything, including billing and role management
`ADMIN`	All	Everything except billing
`MANAGER`	Dashboard, POS, cashier, kitchen	Day-to-day running: orders, customers, stock, staff, reservations
`SUPERVISOR`	Dashboard, POS, cashier, kitchen	Floor lead: orders, voids, cash, shifts — no deletes, no staff changes
`CASHIER`	POS, cashier	Take orders and payments, apply discounts, run the drawer
`WAITER`	POS	Take orders, manage tables and reservations
`COOK`	Kitchen	The kitchen display, and stock and menu read access
`DRIVER`	Driver	Assigned deliveries only
`MARKETING`	Dashboard	Discounts and media
`ACCOUNTANT`	Dashboard	Analytics, billing, stock, cash, and shifts — read-only

#App access

Separate from permissions. A cashier has POS and cashier access but no dashboard access at all — signing in simply takes them to the till. This is why giving someone the right permissions but the wrong role can leave them staring at a screen they cannot use.

#Branch scoping

Owners, admins, marketing, and accountants see every branch. Everyone else sees only the branches they are assigned to, and Restro filters orders, stock, cash, and reports accordingly.

A common support question — why is this screen empty? — is usually an unassigned branch.

#Grants and denials

To give one person something their role does not include, add a grant. To take something away, add a denial. Denials win over grants.

Use these sparingly. If you are granting the same permission to five people, the role is wrong.

#Custom roles

On Enterprise you can define custom roles with an arbitrary set of permissions and app access, and assign staff to them like any built-in role.

#Who can manage whom

A user can only manage users below them in the hierarchy. A manager cannot remove an admin, and nobody can remove an owner.

Did this page miss something? Tell us.