Users, Roles & Permissions

The owner has full access. Every other person gets a login (and optionally a PIN) with a provision: the set of things they may do. Provisions have flat counter permissions shared by every trade, plus a group of permissions for your trade (hospital, hotel, jewellery, projects, gym, parking and the rest) and a few trade fields kept flat so the server can scope data by them (cable areas, field-sales territory, hospital designation). A user's provision is read once at sign-in.

Where it is in the app

Settings > Users (owner / admin). On a local server the Local Admin tool manages server users; in cloud mode My Account under Tools. Field sales adds team members from its own Add Team Member; hospital adds clinical users from its user page.

Flow

flowchart TD
    A[Settings > Users > Add] --> B[Login: user name · password · phone · PIN]
    B --> C[Link to a staff contact
for commission and attendance]
    C --> D[Provision editor: tick permissions]
    D --> D1[Selling: Edit Price in Sales · Voucher Less
Edit Voucher · Delete Voucher · Cash Billing Only]
    D --> D2[Modules: purchase · payment · expense · income · salary · stock adjustment · loan · attendance · reports]
    D --> D3[Masters: add / edit / delete product · add / edit / delete contact]
    D --> D4[Your trade’s group: hospital · hotel · jewellery · projects · gym · parking ...]
    D --> D5[Scope: the areas or territory they cover
and their designation]
    D1 & D2 & D3 & D4 & D5 --> S[(Their permissions, saved)]
    S --> L[User signs in: provision bound for the session]
    L --> M[Menus and buttons appear or hide accordingly]
    E[Owner edits a user's provision] -.->|takes effect on their next login| L

Who signs in: seats by trade

Three different things decide what a person gets, and it helps to keep them apart:

• Role - their standing in the app. Owner and Admin are unrestricted; everyone who actually works a counter or a ward is stored as the restricted User seat.
• Seat - the job they do, picked at the top of the Add User form in trades that have one (Doctor, Front Desk, Site Engineer, Scheme Desk...). It ticks a sensible starting set of switches. In the hospital, on the road and on a building site it is also kept on the login, because a consultant's patients, a rep's territory and an engineer's sites are all pinned to the person.
• Permissions - the switches themselves. Once saved, the seat is its permissions: change any switch afterwards and the person follows the switch, not the label.

Roles every business has

The seat list your trade offers

Add a user in Settings > Users (or from that person's own staff row) and the form you get is the one your trade needs. Each business page has a Who signs in section with a card per seat: the screen it opens on, its phone bottom bar, and what it starts with.

Rules the seat forms share

• Defaults are a starting point, applied to a new seat only. Re-picking the seat on somebody who already exists never overwrites what you set by hand; Reset to role defaults does it deliberately, and warns first.
• Nobody creates a seat above their own. The top seat - Manager, Office, Owner, Administration - is offered only to someone who already has full access. In a hospital a consultant may take on a nurse and nobody else.
• The home screen follows the seat. A restricted login lands where its job starts: a doctor on their own queue, a nurse on the bed board, a rep on the rep shell, a front desk on the arrivals board. Menu groups with nothing granted inside them do not appear at all.
• One person, one form. The staff contact, the login and the permissions are saved together, so hiring somebody is one screen rather than three.
• Taking money in and letting value out are separate grants wherever a trade has both - collecting a scheme instalment is not redeeming the scheme, and posting a folio charge is not settling the stay.
• Asking and approving are separate grants wherever one person commits the business to what another one asked for - raising a site indent is not authorising it, and recording a measurement is not signing for it. On a small business you may give somebody both; it is just never done for you.
• Seeing the money is its own switch, and it is a READ one. Where a trade has it - See Project Money, See Service Revenue - it is the only switch in the group that survives a view-only login, because a read-only owner is exactly who a figure should still be shown to. Turning it off hides the figures and their exports together.
• Whose rows is not the same question as what may be done. A doctor's patients, a rep's territory and a site engineer's sites are narrowed on the server, so somebody holding every switch in a group still sees only their own work. A record outside it reads as not existing rather than as refused.

Permissions

The editor shows the groups for your trade first, then one shared list every business has. These are the labels exactly as they appear on screen.

Shared — every business

One flat list, in this order:

Edit Price in Sales · Product Disc · Voucher Less · Max Less Percentage (shown once Voucher Less is on) · Extra Charges · Rate Type Selection · Edit Voucher · Delete Voucher · Payment Entry · Runs a cashier shift · Cash Billing Only · Show only user created voucher · Stock Adjustment · Manage Purchase · Add Product · Edit Product · Delete Product · Add Contact · Edit Contact · Delete Contact · Less Customer Points · Attendance · Expense · Income · Salary · View Reports.

Your trade’s group

Only the groups that apply to your business are shown, and inside a group a switch appears only when its feature is switched on. Switches marked read only show figures; they are the ones a view-only login keeps.

A restricted user (anyone without full access) sees a trimmed menu; the seat can even change the home screen - a field rep lands on the rep shell, a doctor on the clinical view.

Designing a staff role

flowchart TD
    A[New person joining] --> B{What will they actually do?}
    B -->|bill at the counter| C[Sales rights
no purchase, no reports]
    B -->|manage stock| D[Product and stock rights]
    B -->|collect money| E[Payment rights]
    B -->|run the place| F[Most rights, still not the owner]
    C --> G{Should they change prices?}
    G -->|no| H[Leave price edit and discount off]
    G -->|within a limit| I[Set a maximum discount]
    C --> J{Should they see other people’s bills?}
    J -->|no| K[Show only user created voucher]
    C & D & E & F --> L{Do they handle cash?}
    L -->|yes| M[Runs a cashier shift]
    H & I & K & M --> N[Save · they sign in and it applies]

PINs and devices

A PIN lets a staff member unlock the app quickly on a shared counter; logging out clears it. Devices a user has signed in on are listed; the connection type per device is chosen at first run and can be switched from Tools.