Roles and permissions

Permissions in ChowChirp are named domain:verb, for example documents:write or finance:approve, and are checked on the server for every read and write. Roles bundle permissions; outlet assignment limits where they apply.

Assignable roles

Role	Scope	Typical permissions
Owner	Whole organisation	Everything, including catalogue changes, payment approvals, device pairing and revocation, support approvals, installation handover, AI policy
Manager	Assigned outlets	Documents, stock, purchasing, team, safety, finance operations, cash reviews for those outlets
Kitchen	Assigned outlets	Kitchen screens, prep, 86, food-safety logs, own shifts
Front of house	Assigned outlets	Counter, floor, own shifts and self-service

A person may belong to more than one organisation with a different role in each. The organisation is chosen at login; the outlet can be switched during a session within the person's assignments.

Bounded roles you cannot assign

Role	How it exists
Support (read-only)	Minted for an owner-approved, time-boxed support session. Redacted, read-only, allowlisted views. Never impersonates.
Installer	Not a role. A time-boxed installation assignment approved by an owner. Ends at handover, revocation or expiry. Cannot accept its own handover.

Risk levels and step-up

Each permission carries a risk level. The level decides whether a fresh second factor is required.

Risk	Examples	Requirement
Low	Any :read	Signed-in session
Medium	documents:write (uploads)	Signed-in session
High	Most :write permissions	Elevated session, valid five minutes, from an authenticator code, backup code or passkey
Critical	:approve, :admin, :policy, :export, :privacy, :pay	One-time proof bound to that single action, valid about two minutes, consumed on use

Password re-entry is never accepted as a step-up.

Owner-only actions

Catalogue and unit changes, receiving without a purchase order, quantity-mismatch resolution, device revocation and credential rotation, support access approval, installation handover acceptance, operating-profile approval, period reopen approval, write-off approval, KDS cutover.

Separation of duties in loss prevention

Six loss-prevention personas exist inside the Security screens: loss-prevention manager, analyst, area manager, outlet manager, finance and auditor. Nobody can clear their own exception. Finance cannot clear even a watch-level exception. Only a loss-prevention manager can view restricted cases, close a critical incident or release a legal hold. Auditor access is read-only, time-boxed by a recorded engagement, and watermarked on export.

Where to see it

Settings › Access › Roles shows the full role-by-permission grid for your organisation.

Related

• Set up your team and roles
• Enrol a second factor