---
title: Set up your team and roles
description: Invite managers and staff, give each person the right role and outlets, and understand what each role can and cannot do.
order: 4
updated: 2026-09-16
keywords: team, roles, permissions, invite, outlets, access
---

In this tutorial you invite your first manager, add staff, and set who can see and do what. You also learn the two ideas that make access in ChowChirp different: roles are server-enforced, and the workspace selector never grants anything.

**Who this is for:** owners.

**You will need:** the email addresses of the people you want to invite. About twenty minutes.

## The four roles

| Role           | Typical person               | Can                                                                                              |
| -------------- | ---------------------------- | ------------------------------------------------------------------------------------------------ |
| Owner          | You, a business partner      | Everything, including catalogue changes, payment runs, device pairing, support approvals         |
| Manager        | Outlet or operations manager | Run the outlets they are assigned to: invoices, stock, rosters, safety, purchasing, cash reviews |
| Kitchen        | Cooks, kitchen leads         | Kitchen screens, prep, 86, food-safety logs                                                      |
| Front of house | Servers, cashiers, hosts     | Counter, floor and self-service team screens                                                     |

Every role is limited to the outlets the person is assigned to. Permissions are checked on the server for every read and every write. Hiding a menu item never grants or removes access.

> **Note:** A fifth, read-only role exists only for approved support sessions and cannot be assigned to a person. See [Approve a support access request](/docs/how-to/approve-a-support-access-request).

## Step 1. Invite a manager

1. Open **Settings › Access**.
2. Click **Invite**. Enter the email, choose **Manager**, and tick the outlets they run.
3. Send. The invitation expires after seven days, works once, and cannot grant outlets you do not have yourself.

The manager signs in, sets a password and, on first sign-in, is asked to enrol a second factor.

## Step 2. Preview an access change before you make it

Later, when you change someone's role or outlets, the dialog shows a preview: exactly which permissions and outlets are added or removed. Read it before you confirm. Role changes are recorded in the audit trail.

## Step 3. Add staff to the team directory

Staff who never log in still belong in the team directory so that rosters, time and payroll work.

1. Open **Team › Team directory**.
2. Click **Add person**, or **Import CSV** to add many at once. The import detects duplicate identity numbers.
3. For each person, set their outlet, station, employment type and start date. Foreign workers need a permit record with an expiry date; an expired permit blocks their shifts.

Staff who will use the self-service screens are invited from the same directory with the **Front of house** or **Kitchen** role.

## Step 4. Set up station PINs for kiosks

If an outlet has a shared kiosk for clock-in or a counter device, each person needs an individual PIN. Open **Settings › Devices** and manage the operational PIN roster for the station. PINs are per person, never shared.

## Step 5. Check the role matrix

**Settings › Access › Roles** shows the full role-by-permission grid. Use it when someone asks "why can't I see this?". The answer is usually the outlet assignment, not the role.

## What you have learned

- Four roles, all scoped to outlets, all enforced on the server.
- Invitations are single-use, expiring and bounded by your own authority.
- Access changes show a preview and leave a trail.
- Staff in the directory drive rosters and payroll even if they never log in.

## Next steps

- [Invite a team member and set outlet access](/docs/how-to/invite-a-team-member)
- [Roles and permissions](/docs/reference/roles-and-permissions)
- [Build and publish the weekly roster](/docs/how-to/build-the-weekly-roster)