Users and access

Add a teammate, choose the outlets and modules they can reach, and read the access summary on the Users page.

Organisation → Users is the tenant’s people directory: who is on the team, and what each person can open. Adding a user and editing their access are both owner-only. Everyone else can read the list.

Nothing is invited

Adding a user is not an invitation. Nothing is sent, no message travels, no link is emailed. What happens is that a login is created with a PIN, and you read that PIN out to the person. They sign in with it and change it themselves.

The list

Each row is a person: their full name, and under it their phone or email, whichever they sign in with. To the right sits one summarised access cell and a status chip reading Active or Inactive. The row’s menu deactivates or reactivates the account, and the header counts the teammates.

The access cell is a summary, not the full grant list:

• Outlet grants collapse to one line per role, highest role first. Up to four outlets are named (“Manager · Banjara Hills + 3”); above that the line counts them (“Owner · 11 outlets”).
• Module grants dedupe to one chip per distinct role, spelled in plain words: “POS manager”, “Ops admin”.
• An organisation admin gets its own leading chip reading Admin, because admin everywhere outranks any single module grant.
• Someone with no grants yet reads No access yet.

Click a row to open that person’s drawer, which holds the truth behind the summary.

Owners

A tenant owner is an admin with three more things:

• They get every summary email.
• They manage who gets the summary emails (the Summary emails tab on this page).
• Only an owner can make another person an owner, or remove an owner.

An owner’s row has an Owner chip.

Admins keep everything they could do before, with one limit. An admin who is not an owner cannot do these three things to an owner:

• switch the owner off or on,
• reset the owner’s PIN, or change the phone or email they sign in with,
• change the owner’s roles or outlets.

An admin who opens an owner’s row sees what the owner can reach, and one line: Only an owner can change this person. There is no Deactivate and nothing to edit. This is the same in every module, not only here.

To make someone an owner, open their row and switch Tenant owner on. Only an owner sees this switch. If the person is not an admin yet, they become one. To take admin away from an owner, remove owner first.

A business always keeps one active owner. You cannot remove or switch off the last one. Make another person an owner first.

Resetting a PIN

Open the person’s row and press Reset PIN, or use the menu at the end of the row. You are asked to confirm. The person is signed out everywhere.

You then see a temporary PIN. It is shown once. Copy it and share it with the person. They sign in with it and must set a new PIN straight away.

You do not see Reset PIN for yourself (use Change PIN), for a counter (change it in Counters and screens), or for an owner unless you are an owner.

Adding a user

Press Add user. The form asks for identity, a PIN, and what the person can reach.

If the phone or email already belongs to someone, the field says so and nothing is created.

The access question, asked once

Access is asked as a short question rather than one grant at a time, on both the add-user form and the drawer, so granting a manager eleven outlets is four answers rather than thirty-three:

1. Organisation admin is a switch at the top: full access across every module, wherever the business goes. Leave it off for everyone who is not running the whole estate.
2. Outlets is a tick list of your live outlets, with an All outlets tick that takes the lot. It shows a mixed state when only some are ticked.
3. Role at those outlets is a single choice, applied everywhere you ticked: Owner, Manager, Staff or Viewer.
4. Modules is a tick list of the modules your business has switched on (Procurement, POS, Ops, Reserve, Studio, Smartlinks, Loyalty), each with its own role select beside it. A ticked module is granted at every outlet you chose above.

If you have no active outlets yet, the form says so and asks you to add one first. If no modules are switched on, it says that instead.

Exceptions, and the drawer

The short form cannot say “manager everywhere except staff at one outlet”. For that, open the person’s row. The drawer has three chapters:

• Person: their phone, email and whether the account is active.
• Access: the same short question as above, filled in from what they currently hold.
• Grants: every grant they actually have, in two lists, Outlet roles and Module roles. Each row carries its own role select and a remove button, and a module row names the outlet it applies at (or All outlets). This is where a per-outlet exception is set, and it is the honest reading when the short form has had to round their access off.

Removing an outlet grant also removes any module grants scoped to that outlet, since module access at a place the person cannot reach means nothing. And because the short Access question can only say one role across the outlets it ticked, answering it drops the exceptions the grant list held. The drawer names exactly what a save is about to take away before you commit it.

Saving writes the organisation-admin marker first, then the outlet grants, then the module grants, so a refused change (removing the last admin of the tenant, for instance) lands before anything else is written.