> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ofatoura.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Staff and Permissions Overview

> Understand how oFatoura controls who can do what — roles, custom permission tiers, per-user overrides, and manager override PINs for your restaurant staff.

This section is where you decide who works at your restaurant and exactly what each person can do. Owners and managers use it from the web dashboard (browser) to add staff, build roles, fine-tune individual permissions, and set up manager approvals for sensitive actions.

## How permissions work

oFatoura controls access with **roles**. Every staff member is assigned one role (for example, Waiter, Cashier, or a custom role you create), and that role carries a set of permissions. Permissions are the single source of truth for what someone can see and do — both in the web dashboard and in the ePOS waiter app.

You can shape access at three levels:

1. **Roles** — the main building block. Each role has a list of permissions, and you can apply ready-made tiers (Starter, Standard, Advanced) to set a role up quickly.
2. **Per-user overrides** — grant or deny a single permission for one person, independent of their role, without changing the role for everyone else.
3. **Manager override PINs** — require a manager's PIN approval before a staff member can complete a sensitive action such as a refund or a void.

<Info>
  Roles and permissions are scoped to your restaurant. The same role name can exist at different restaurants without conflict, so what you build here only affects your own team.
</Info>

## Protected roles

A few roles are built in and protected: **Admin**, **Super Admin**, **Branch Head**, **Waiter**, and **Chef**. These roles cannot be renamed or deleted, which keeps core access stable. You can still create your own custom roles alongside them and assign permissions freely.

<Warning>
  On a newly created restaurant, the **Waiter** and **Chef** roles start with **zero permissions**. Before staff in those roles can take orders, open shifts, or clock in, you must grant the permissions they need — either by applying a permission tier or by selecting permissions one by one. See [Creating Roles and Applying Permission Tiers](/staff/roles-and-tiers).
</Warning>

## In this section

<Columns cols={2}>
  <Card title="Adding and Managing Staff Members" icon="user-plus" href="/staff/adding-staff">
    Add staff with login credentials, assign primary and secondary branches, and manage the staff list.
  </Card>

  <Card title="Creating Roles and Applying Permission Tiers" icon="shield" href="/staff/roles-and-tiers">
    Build custom roles, set permissions on a module-grouped grid, and apply Starter, Standard, or Advanced presets.
  </Card>

  <Card title="Per-User Permission Overrides" icon="user-check" href="/staff/user-permission-overrides">
    Grant or deny a single permission for one person, independent of their role.
  </Card>

  <Card title="Manager Override PINs for Sensitive Actions" icon="key" href="/staff/manager-override-pins">
    Set up manager PIN approval for refunds, voids, discount edits, and other sensitive actions.
  </Card>

  <Card title="Staff Attendance Records (Web Admin)" icon="clock" href="/staff/attendance-admin">
    Review check-in and check-out records, approve attendance, and export reports.
  </Card>
</Columns>

## Where to start

<Steps>
  <Step title="Set up your roles first">
    Open Role Settings and give each role the permissions it needs. New restaurants should grant the Waiter and Chef roles their starting permissions before anything else.
  </Step>

  <Step title="Add your staff">
    Create each staff member, choose their role, and assign their branches. They receive a welcome email with login details automatically.
  </Step>

  <Step title="Fine-tune as needed">
    Use per-user overrides for one-off exceptions, and set up a manager PIN so sensitive actions require approval.
  </Step>
</Steps>

## Related

* [Switching Active Branch in the Web Admin](/getting-started/switching-branches-web)
* [Branches and Operating Hours](/settings/branches-and-operating-hours)
* [Waiter App (ePOS) Settings](/settings/waiter-app-settings)