Users and permissions

Open Users to manage who can sign in. Every user gets their own account, and every sale, void and shift is recorded against whoever was signed in at the time.

Adding a user

Each account has:

• Username — what they type to sign in.
• Display name — what appears on receipts and in reports.
• PIN or password — a short PIN for cashiers on a touch screen, a longer password for administrators.
• Active — untick to block sign-in without deleting the account.
• Permissions — which screens they may open.

Permissions

You tick, per user, which of these ten screens they can reach: pos, dashboard, products, stock, customers, documents, reports, promotions, users and settings.

A screen that is not ticked simply is not available to that user. This is the main control you have, so it is worth thinking about rather than ticking everything.

Sensible starting points

Cashier — pos only. Possibly customers, if they are expected to sign people up.

They can sell, and that is the job. Not giving them Products means a price cannot be quietly edited mid-shift. Not giving them Documents means a sale cannot be voided after the fact without a supervisor.

Supervisor — pos, documents, customers, stock, reports.

Enough to run the floor, handle a refund and count a shelf, without being able to change what things cost or who can sign in.

Manager — everything except users and settings.

Owner or administrator — everything.

The two to be careful with are users and settings. Users lets someone create an account and grant themselves anything. Settings holds the tax rates and the ZATCA configuration, where a careless change has consequences that show up in a tax filing rather than on the day.

Why per-person accounts matter

It is tempting on a busy counter to have one shared login. Resist it. The moment there is one login, the audit log records “the till did it” and every management screen becomes decoration. You cannot tell who voided the sale, whose drawer was short, or who is your best seller.

The cost of doing it properly is about two seconds per handover, using Lock rather than staying signed in.

When someone leaves

Untick Active. Do not delete them.

A deactivated user cannot sign in, but their name stays attached to every sale they ever rang up, which is what you need if a question comes up about a transaction from three months ago. Deleting the account to tidy the list costs you that history.

Changing a PIN

Edit the user and set a new PIN. Do this immediately if one has been seen or shared, and as a matter of routine when someone leaves and their PIN was known to others.

Reviewing it occasionally

Twice a year, open Users and read the list. Look for accounts belonging to people who no longer work there, accounts with more permissions than the job needs, and the number of people who can reach Settings. It takes five minutes and it is the cheapest control in the app.