Roles & permissions
The five built-in roles and how permissions are decided.
Staff get their abilities through roles, and through nothing else — there are no per-person permission tweaks. What a staff member can do is the sum of the roles they hold; the Administrator bypasses the system entirely.
Who can do this: staff with Manage Role permissions can view the roles pages; authoring your own roles is a separate, plan-gated ability — see Custom roles.
The five built-in roles#
Every business ships with five ready-made roles. They cannot be edited or deleted — "System roles are managed by the platform and cannot be edited." — so they are always there to fall back on.
| Role | Scope | What it is for |
|---|---|---|
| Admin | Global | Full access to every business feature — the closest a staff member gets to the Administrator. |
| Store Admin | Store | Runs a store end to end: orders, invoices, returns, refunds, inventory in full; sees (but does not change) the catalogue and business-level settings. |
| Cashier | Store | Runs the counter — orders, invoices, returns and refunds end to end, looking up products and customers. Cannot change the catalogue, prices or staff. |
| Inventory Manager | Global | Full control of products, categories, images and inventory across every store — business-wide, because the catalogue itself is business-wide. |
| Reports Viewer | Global | Read-only oversight: every report and every list, business-wide, with no ability to change anything. |
How access is worked out#
- Global vs store scope. A globally-scoped staff member's roles apply everywhere. A store-scoped staff member holds roles per store — Cashier in one shop, Store Admin in another — and holds nothing outside their stores.
- Under "All Stores", store-scoped staff hold nothing. The combined view belongs to people with business-wide access; a store-scoped colleague works within a selected store.
- A staff member with no roles is view-only. They can open pages and read, but every change is refused — the invite form warns you when you are about to create one.
- A disabled role grants nothing, but stays assigned. Disabling a role is how you suspend a whole group's access in one action; re-enabling restores it exactly. Deleting a role is refused while anyone still holds it.
When a page or button is missing for someone, it is usually not a bug: the app hides actions a person cannot take, so a view-only screen looks clean rather than broken. If they open a page they truly cannot use, it says which permission is missing.