Roles you compose, and approvals for the rest

A permission matrix, not three fixed roles

Forty-one resources across selling, catalogue, inventory, accounting, money and administration, each set to none, view, request or edit. Build a role, name it, and assign it. Four editable presets — Finance, Inventory controller, Shift manager, Cashier — are there to start from.

"Request" is the interesting level

Some operations are genuinely owner-only at the database level and no grant can change that. Setting one of those to request lets an employee raise it as a request instead: they file it, the owner sees it in a queue with the details, and approving it executes the operation under the owner’s own authority. The work gets started by the person who noticed, and finished by the person accountable.

• Period lock and year-end close
• Refunds
• Voiding an invoice or a bill
• Store settings, including the currency
• Stock adjustments

A role can only ever narrow

Permissions sit on top of the database’s own access control rather than replacing it, and are only ever able to take access away. That means the database remains a genuine backstop: a mistake in a role, or a deployment that has not happened yet, can only deny something — never grant it.

Shifts and the drawer

Shifts with a per-cashier opening float, expected cash in the drawer at close, and a warning for sales rung up outside shift hours. Shift reports export to PDF and Excel.