Skip to main content
Some actions are too sensitive to leave fully open to every staff member. Manager override lets a regular staff member start one of these actions, then have a manager step in and approve it on the spot by entering a PIN. The approval is recorded, time-limited, and tied to that one action only. This page explains how managers set up their PIN and how the override flow works in the web admin. The same override system is also used in the ePOS waiter app — see ePOS App Settings and Manager Overrides.

​
Permissions

  • A manager who will approve overrides needs the Manager Override capability. Only staff with this capability can have a working override PIN.
  • The staff member starting the sensitive action needs the normal permission for that action (for example, the refund permission to start a refund). Manager override is an extra approval step on top — it does not replace the underlying permission.

​
How it works

When a staff member tries to perform a protected action, an approval window appears. A manager enters their PIN to approve it, and the action is allowed to continue.
1

Staff starts a sensitive action

The staff member begins something that requires approval — for example, processing a refund or voiding an item that already went to the kitchen. An override window opens showing which action is being approved.
2

A manager enters their PIN

A manager with the Manager Override capability types their PIN (4 to 12 characters) into the window. The PIN is masked as it is typed.
3

The system checks the PIN

The PIN is checked against the managers set up for your branch. If it matches a manager who is allowed to approve, the action is approved.
4

The action continues

Once approved, the action goes through. The approval is valid only for that one action and only for a short time (5 minutes), then it expires.

​
Actions that can require an override

Manager override is used as a guardrail on sensitive money and order operations, including:
  • Processing refunds
  • Voiding payments
  • Voiding items after they have already been sent to the kitchen
  • Editing or applying discounts
  • Editing or removing items on an order
  • Recalling a kitchen ticket outside the allowed window
  • Closing a shift with a cash variance
  • Marking an order tax-exempt
  • Splitting an order
Which actions require an override, and the limits that trigger one (for example, a tip above a certain amount), depend on your branch settings. A manager can predict in advance whether an action will need approval before submitting it.

​
Setting up a manager PIN

Each manager who will approve overrides sets their own PIN. The PIN is set in the manager’s own settings, and it doubles as the quick PIN used to unlock and switch users on the ePOS app — see Logging In, Quick PIN, and Switching Users.
No two people in the same branch can share the same PIN. If you try to set a PIN that another manager already uses, you will be asked to choose a different one. This keeps every approval traceable to a single person.
A PIN is between 4 and 12 characters. Pick something memorable but not obvious, and avoid sharing it.
If two managers in a branch somehow end up with the same PIN, the system refuses the override rather than guess who approved it. Always keep PINs unique so approvals are never ambiguous.

​
Letting managers skip the PIN (self-approve)

Each branch has a “managers skip PIN” setting. When it is turned on, a manager who is already signed in and starts a sensitive action themselves does not have to re-enter a PIN — their own permission self-approves the action. Staff without the Manager Override capability still see the approval window and still need a manager’s PIN.
Turn this on at branches where managers do most of the refunds and voids themselves, so they are not re-typing a PIN all day. Leave it off where you want a deliberate PIN step on every sensitive action, even from managers.

​
Security: rate limiting and lockout

To stop someone guessing a PIN, attempts are limited per device:
  • After 5 failed attempts on the same device within 60 seconds, that device is locked out and shows an error.
  • Wait for the short lockout to pass, then try again with the correct PIN.

​
Single-use, action-scoped approvals

Each approval is tied to one specific action and cannot be reused:
  • An approval is single-use — once it is spent on the action it approved, it is gone.
  • An approval is action-scoped — approving a refund does not also approve a void or a discount edit. Each sensitive action needs its own approval.
  • An approval expires after 5 minutes. If the staff member waits too long before completing the action, they will need a fresh approval.

​
Audit trail

Every manager override is recorded. The record notes who started the action, which manager approved it, what the action was, and the related context. This gives you a clear, after-the-fact trail of who authorized each sensitive operation — useful when reviewing refunds, voids, and discounts.

Voiding Items and Processing Refunds

The sensitive actions that most often trigger a manager override.

ePOS App Settings and Manager Overrides

How the same override flow works on the waiter app.

Roles and Permission Tiers

Decide which roles hold the Manager Override capability.

Per-User Permission Overrides

Grant or deny capabilities to a single staff member.