---
title: Roles and permissions
description: The four assignable roles, what each can do, how outlet scope and step-up apply, and the bounded roles for support and installers.
order: 1
updated: 2026-09-16
keywords: roles, permissions, owner, manager, kitchen, front of house, support, installer, step-up
---

Permissions in ChowChirp are named `domain:verb`, for example `documents:write` or `finance:approve`, and are checked on the server for every read and write. Roles bundle permissions; outlet assignment limits where they apply.

## Assignable roles

| Role               | Scope              | Typical permissions                                                                                                                            |
| ------------------ | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| **Owner**          | Whole organisation | Everything, including catalogue changes, payment approvals, device pairing and revocation, support approvals, installation handover, AI policy |
| **Manager**        | Assigned outlets   | Documents, stock, purchasing, team, safety, finance operations, cash reviews for those outlets                                                 |
| **Kitchen**        | Assigned outlets   | Kitchen screens, prep, 86, food-safety logs, own shifts                                                                                        |
| **Front of house** | Assigned outlets   | Counter, floor, own shifts and self-service                                                                                                    |

A person may belong to more than one organisation with a different role in each. The organisation is chosen at login; the outlet can be switched during a session within the person's assignments.

## Bounded roles you cannot assign

| Role                    | How it exists                                                                                                                                  |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| **Support (read-only)** | Minted for an owner-approved, time-boxed support session. Redacted, read-only, allowlisted views. Never impersonates.                          |
| **Installer**           | Not a role. A time-boxed installation assignment approved by an owner. Ends at handover, revocation or expiry. Cannot accept its own handover. |

## Risk levels and step-up

Each permission carries a risk level. The level decides whether a fresh second factor is required.

| Risk     | Examples                                                       | Requirement                                                                              |
| -------- | -------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| Low      | Any `:read`                                                    | Signed-in session                                                                        |
| Medium   | `documents:write` (uploads)                                    | Signed-in session                                                                        |
| High     | Most `:write` permissions                                      | Elevated session, valid five minutes, from an authenticator code, backup code or passkey |
| Critical | `:approve`, `:admin`, `:policy`, `:export`, `:privacy`, `:pay` | One-time proof bound to that single action, valid about two minutes, consumed on use     |

Password re-entry is never accepted as a step-up.

## Owner-only actions

Catalogue and unit changes, receiving without a purchase order, quantity-mismatch resolution, device revocation and credential rotation, support access approval, installation handover acceptance, operating-profile approval, period reopen approval, write-off approval, KDS cutover.

## Separation of duties in loss prevention

Six loss-prevention personas exist inside the Security screens: loss-prevention manager, analyst, area manager, outlet manager, finance and auditor. Nobody can clear their own exception. Finance cannot clear even a watch-level exception. Only a loss-prevention manager can view restricted cases, close a critical incident or release a legal hold. Auditor access is read-only, time-boxed by a recorded engagement, and watermarked on export.

## Where to see it

**Settings › Access › Roles** shows the full role-by-permission grid for your organisation.

## Related

- [Set up your team and roles](/docs/tutorials/set-up-your-team)
- [Enrol a second factor](/docs/how-to/enrol-a-second-factor)