Permissions matrix
This reference separates POS operating policy from the Admin permissions enforced by the server. For a configurable Admin role, the live Admin → Role Permissions page is the final answer to "can I do X?".
Roles (lowest → highest)
| Level | Role | Where | Typical person |
|---|---|---|---|
| 2 | Receptionist | POS employment role | Front desk staff |
| 3 | Therapist | POS employment role | Service providers |
| 4 | Manager (manager) | POS employment role | Day-to-day store leader |
| 5 | Owner (owner) | POS employment role | Business owner (may manage remotely) |
| 6 | Store manager (store_manager) | Admin account | Manages directly bound stores |
| 7 | Regional manager | Admin account | Oversees a store group |
| 8 | Tenant admin | Admin account | Top-level business admin |
| 9 | Super admin | Admin account (platform) | The vendor |
Store manager is an Admin account role bound directly to one or more stores. It is separate from the POS manager employment role. Super admin is the platform (vendor) role.
POS actions
POS enforces PIN and shift, not role. These rows describe store policy and what the POS interface offers, not a server-side block. The only server-enforced POS role gates are the three settlement management actions — listing reopen requests, requesting a reopen and amending a draft settlement — which require a manager or owner employment.
| Action | Receptionist | Therapist | Manager | Owner+ |
|---|---|---|---|---|
| Clock in / out | ✓ | ✓ | ✓ | ✓ |
| Open cash drawer | ✓ | — | ✓ | ✓ |
| Create visit | ✓ | ✓ | ✓ | ✓ |
| Add service to visit | ✓ | ✓ | ✓ | ✓ |
| Start / complete service | ✓ | ✓ | ✓ | ✓ |
| Adjust service (time/price) | ✓ | ✓ | ✓ | ✓ |
| Transfer service to another therapist | ✓ | ✓ | ✓ | ✓ |
| Void a service | ✓ | — | ✓ | ✓ |
| Take payment | ✓ | ✓ | ✓ | ✓ |
| Apply voucher / coupon / package | ✓ | ✓ | ✓ | ✓ |
| Refund a payment | ✓ | ✓ | ✓ | ✓ |
| Close visit (balance = 0) | ✓ | ✓ | ✓ | ✓ |
| Force close visit (balance > 0) | — | — | ✓ | ✓ |
| Record cash expense | ✓ | — | ✓ | ✓ |
| Run Pre-Settlement preview † | ✓ | ✓ | ✓ | ✓ |
| Complete Final Settlement | ✓ | — | ✓ | ✓ |
| Request Settlement correction | ✓ | — | ✓ | ✓ |
| Sell voucher | ✓ | — | ✓ | ✓ |
| Refund voucher sale | — | — | ✓ | ✓ |
| Create appointment | ✓ | ✓ | ✓ | ✓ |
| Check-in / cancel / no-show appointment | ✓ | ✓ | ✓ | ✓ |
| Create tax invoice | ✓ | ✓ | ✓ | ✓ |
| Print / email receipt | ✓ | ✓ | ✓ | ✓ |
| Mark returning guest | ✓ | ✓ | ✓ | ✓ |
| Change room status | ✓ | ✓ | ✓ | ✓ |
† Any operator on the activated device can open the Pre-Settlement preview; it identifies no operator and creates nothing.
Admin actions
Where an action is governed by a named permission, its code is shown in code. The table shows the fixed roles and the regional-manager defaults. Store-manager permissions are tenant-configurable: by default they cover roster/time-off, waitlist/no-show review, sales read, payroll summary, review moderation, financial-correction requests, treatment-record lock/correction, voucher instances, feedback and the setup checklist, always limited to directly bound Stores. Check Admin → Role Permissions for the live regional-manager and store-manager values.
| Action | Tenant admin | Regional manager | Super admin |
|---|---|---|---|
| View dashboard (own stores) | ✓ | ✓ | ✓ |
| View dashboard (all stores) | ✓ | group only | ✓ |
| Edit store details & settings | ✓ | ✓ | ✓ |
Moderate customer reviews (reviews.moderate) | ✓ | ✓ | ✓ |
Create / edit services & categories (catalog.manage) | ✓ | —¹ | ✓ |
Create / edit rooms (catalog.manage) | ✓ | —¹ | ✓ |
Create / edit employees (employees.write) | ✓ | —¹ | ✓ |
Create / edit employments (employees.write) | ✓ | —¹ | ✓ |
Reset staff PIN (employees.pin.reset) | ✓ | —¹ | ✓ |
Edit roster (roster.schedule.manage) | ✓ | —¹ | ✓ |
Review time-off requests (roster.time_off.manage) | ✓ | —¹ | ✓ |
| View roster (group stores) | ✓ | ✓ | ✓ |
| View shift records | ✓ | ✓ | ✓ |
| View / manage appointments | ✓ | ✓ | ✓ |
Manage the waitlist (booking.waitlist.manage) | ✓ | —¹ | ✓ |
| Approve Settlement correction | ✓* | ✓* | ✓* |
| Approve cash variance | ✓* | ✓* | ✓* |
| Approve stocktake reopen | ✓* | ✓* | ✓* |
| View settlements & download PDF | ✓ | ✓ | ✓ |
| View daily report | ✓ | ✓ | ✓ |
| View transaction history | ✓ | ✓ | ✓ |
| View audit log | ✓ | ✓ | ✓ |
| Manage voucher templates | ✓ | ✓ | ✓ |
| Manage coupon templates | ✓ | ✓ | ✓ |
| Manage package templates | ✓ | ✓ | ✓ |
Manage inventory items (catalog.manage) | ✓ | —¹ | ✓ |
| Create stock receipt | ✓ | ✓ | ✓ |
| Create / confirm stocktake | ✓ | ✓ | ✓ |
| View / manage treatment records | ✓ | ✓ | ✓ |
| Lock treatment record | — | ✓ | ✓ |
| Request treatment-record correction | — | ✓ | ✓ |
| Void tax invoice | ✓ | ✓ | ✓ |
| View email log & retry | ✓ | ✓ | ✓ |
| Edit email templates | ✓ | — | ✓ |
| Submit feedback | ✓ | ✓ | ✓ |
| View customer list | ✓ | ✓ | ✓ |
Reveal customer PII (customers.pii.reveal) | ✓ | —¹ | ✓ |
| Create / edit customers | ✓ | ✓ | ✓ |
| Manage store groups | ✓ | — | ✓ |
| Manage sharing policies | ✓ | — | ✓ |
| Create / manage Twin | ✓ | — | ✓ |
| Confirm Twin membership | ✓ | ✓ | ✓ |
View payroll summary (payroll.summary.read) | ✓ | ✓ | ✓ |
Manage payroll config (payroll.config.read / payroll.config.write) | ✓ | —¹ | ✓ |
Approve payroll period (payroll.write) | ✓ | —¹ | ✓ |
Mark payroll as paid (payroll.write) | ✓ | —¹ | ✓ |
| Manage insurance groups | ✓ | ✓ | ✓ |
| Register provider numbers | ✓ | ✓ | ✓ |
Approve lifecycle marketing campaigns (marketing.campaign.approve) | ✓ | —¹ | ✓ |
View AI insights (ai.insights.read, plus AI credits) | ✓ | ✓ | ✓ |
Raise a hardware support ticket (platform_support.ticket.submit) | ✓ | —¹ | ✓ |
Accept platform terms (platform_terms.accept, non-delegable) | ✓ | — | — |
Edit regional-manager permissions (admin.role_permissions.manage) | ✓ | — | ✓ |
| Create admin accounts | ✓ | — | ✓ |
| Change MFA policy | — | — | ✓ |
| View / toggle store features | — | — | ✓ |
¹ Not granted by default. A tenant admin can grant or revoke named permissions for both regional managers and store managers under Admin → Role Permissions. platform_terms.accept can never be delegated. A permission override never widens the account's Store scope.
* Self-approval is blocked for stocktake reopen and financial corrections. Settlement reopen relies on structural separation instead: the request is raised by a POS employee and approved by an Admin account.
Key principles
- Every POS action has an operator — routine lower-risk actions are attributed to the server-validated selected operator; sensitive or elevated actions are attributed to the PIN-verified operator. Never use someone else's operator identity or PIN.
- Higher roles inherit lower — a manager can do everything a receptionist can, plus more.
- Separation of duties — certain actions (approve Settlement correction, approve variance) cannot be performed by the person who initiated the request.
- Feature gates apply on top — even if your role allows an action, it only works if the feature is enabled for your store.
- Manager scope is independent of permissions — regional managers stay within their Store Group and store managers stay within directly bound Stores; a tenant override can change capabilities but cannot broaden that scope.