Who gets in, and what they can touch.
Sections, roles, employees and branches on one side; two-factor authentication, token rotation and a complete audit trail on the other. Cashiers see the counter. Owners see everything.
Section-level permissions as a plain checkbox matrix.
Cost-10 password hashing with optional authenticator 2FA.
A 30-minute access token and 2-hour refresh rotation.
Every login IP-attributed, listed, and revocable by the owner.
Configure downward: sections, then roles, then people, then places.
Permission, from route to person.
Access control fails when it is a single admin password shared by nine people. This is built the other way round: a permission is a group of routes, a role is a set of permissions, an employee has one role and one branch, and nothing is visible outside that intersection.
Enforced twice: menus disappear in the interface, and the routes refuse the request.
Section permission matrix
Tick exactly which parts of the system a role can reach. Payroll and P&L stay off the counter.
Branch-locked staff
A branch employee sees only their outlet’s orders, customers, expenses and staff. Not the chain.
Dual identifier login
Staff sign in with an email address or the employee code printed on their badge.
Two-factor authentication
TOTP via any authenticator app, provisioned by QR code, enforceable across management roles.
Self-service recovery
A six-digit OTP by email with a five-minute lifetime replaces the “call the developer” password reset.
Role duplication
Clone a role to create a senior variant, change two boxes, and it is done.
The technical detail your IT reviewer will ask for.
What is actually enforced.
The risks this removes.
- No shared admin passwordEvery action belongs to a named employee, which is what makes an audit trail meaningful.
- Sensitive data stays sensitiveJunior staff cannot open payroll, change tax settings or bulk-export your customer list.
- Disputes end quicklyThe activity log shows who changed a price from ₹150 to ₹100, from which IP, at what minute.
- One-click offboardingDeactivating a leaving employee revokes their sessions and their access immediately.
Enforcing two-factor authentication on management roles removes almost the entire account-takeover risk.
An auditor investigating a discount opens the activity log for an order, sees employee EMP-012 changed the line price at 2:14 PM from a specific IP, and closes the question in under a minute.
Log in as a cashier, then as an owner.
The sandbox ships with both accounts. The difference in what you can see is the whole point.