Set up your team and roles

In this tutorial you invite your first manager, add staff, and set who can see and do what. You also learn the two ideas that make access in ChowChirp different: roles are server-enforced, and the workspace selector never grants anything.

Who this is for: owners.

You will need: the email addresses of the people you want to invite. About twenty minutes.

The four roles

Role	Typical person	Can
Owner	You, a business partner	Everything, including catalogue changes, payment runs, device pairing, support approvals
Manager	Outlet or operations manager	Run the outlets they are assigned to: invoices, stock, rosters, safety, purchasing, cash reviews
Kitchen	Cooks, kitchen leads	Kitchen screens, prep, 86, food-safety logs
Front of house	Servers, cashiers, hosts	Counter, floor and self-service team screens

Every role is limited to the outlets the person is assigned to. Permissions are checked on the server for every read and every write. Hiding a menu item never grants or removes access.

Step 1. Invite a manager

1. Open Settings › Access.
2. Click Invite. Enter the email, choose Manager, and tick the outlets they run.
3. Send. The invitation expires after seven days, works once, and cannot grant outlets you do not have yourself.

The manager signs in, sets a password and, on first sign-in, is asked to enrol a second factor.

Step 2. Preview an access change before you make it

Later, when you change someone's role or outlets, the dialog shows a preview: exactly which permissions and outlets are added or removed. Read it before you confirm. Role changes are recorded in the audit trail.

Step 3. Add staff to the team directory

Staff who never log in still belong in the team directory so that rosters, time and payroll work.

1. Open Team › Team directory.
2. Click Add person, or Import CSV to add many at once. The import detects duplicate identity numbers.
3. For each person, set their outlet, station, employment type and start date. Foreign workers need a permit record with an expiry date; an expired permit blocks their shifts.

Staff who will use the self-service screens are invited from the same directory with the Front of house or Kitchen role.

Step 4. Set up station PINs for kiosks

If an outlet has a shared kiosk for clock-in or a counter device, each person needs an individual PIN. Open Settings › Devices and manage the operational PIN roster for the station. PINs are per person, never shared.

Step 5. Check the role matrix

Settings › Access › Roles shows the full role-by-permission grid. Use it when someone asks "why can't I see this?". The answer is usually the outlet assignment, not the role.

What you have learned

• Four roles, all scoped to outlets, all enforced on the server.
• Invitations are single-use, expiring and bounded by your own authority.
• Access changes show a preview and leave a trail.
• Staff in the directory drive rosters and payroll even if they never log in.

Next steps

• Invite a team member and set outlet access
• Roles and permissions
• Build and publish the weekly roster