Staff PINs and permissions: who can do what

Why one PIN per person

When everyone uses the same login, every void, discount and cash payout is "the POS's". When something goes wrong — a drawer short, a discount nobody remembers, a dish voided after it was cooked — there is no one to ask.

A personal PIN fixes that at almost no cost. Staff tap their name, type a short PIN and work as themselves. Every order, payment and cash movement carries a name. Honest staff are protected too, because the record shows what they actually did.

What a good PIN routine looks like

• One PIN per person, never shared. If two people know the same PIN, it isn't personal any more.
• Long enough to guess slowly. Six digits are much harder to guess than four.
• No easy patterns. 111111, 123456 and birthdays are the first things someone tries.
• Locked when walking away. A POS left signed in is a shared login again. Lock it, or let it lock itself after a short idle time.
• Changed when it may be known. If someone saw it being typed, change it.

Roles: give each job what it needs

Think in jobs, not people. A waiter, a cashier, a cook, a storekeeper, a manager and an accountant need different things:

• Waiters take orders and send them to the kitchen; they may not need to take payment.
• Cashiers take payment and open and close the drawer.
• Kitchen staff see tickets, not money.
• Storekeepers count stock but should not approve their own corrections.
• Managers approve the sensitive actions and see the reports.
• Accountants need figures and exports, not the POS.

Start from those roles and switch permissions on or off only where your restaurant really differs.

The actions that need a second person

Some actions move money or hide mistakes. Ask for a manager's approval on them, every time:

• voiding a dish the kitchen has already started;
• making a dish complimentary;
• cancelling an order;
• discounts above a set limit;
• refunds;
• cash payouts from the drawer;
• closing a drawer that is over or short by more than a small amount.

The approver should never be the person asking. That one rule closes most of the easy ways money goes missing.

Discount limits

Rather than "can discount" or "can't", set a limit per role: a cashier might give up to 10% on their own, a manager more. A small allowance for complimentary items — a coffee for a regular who waited too long — saves calling a manager over for every small gesture.

When someone leaves

On the day someone leaves, end their access everywhere at once: their PIN, their roles, any back-office sign-in. Keep their name on past bills and reports — the history should still say who did what. If they come back, give them a new PIN rather than the old one.

Shared devices, busy shifts

Personal PINs only work if switching is fast. Look for:

• a list of names on the POS, so nobody types a username;
• a switch-user button that takes two taps;
• approval that can happen on the spot — a manager typing their PIN on the same screen, or approving from their phone.

How BillDine does it

• A PIN per person, no email needed. Add a waiter, cashier or cook with their name, outlet, role and a 6-digit PIN; they appear on the POS's list of names at once. People who use the back office also sign in by email and choose their own PIN. Simple PINs — one digit repeated, a plain run of numbers — are refused.
• Signing in and handing over. On a paired POS terminal, staff tap their name and enter their PIN. Switch user hands over in two taps, Lock POS keeps the screen safe, and the POS locks itself after a time a manager sets. Too many wrong PINs block that PIN on the terminal for a while.
• Roles. BillDine starts you with Owner, Manager, Head Chef, Cashier, Waiter, Kitchen Staff, Storekeeper and Accountant. The owner can turn each permission on or off, cap the discount a role may give, let small complimentary items through without approval up to an amount, and create new roles. With several outlets, a role is given at one outlet, one brand or across the business. Nobody can give anyone more access than they have.
• Approvals. Voiding a dish the kitchen already has, a complimentary dish or cancelling an order needs an owner or manager: they tap their name on the approval pad and enter their own PIN, or approve on their phone. Nobody approves their own request.
• A name on everything. Orders, discounts, payments, cash movements, voids and refunds are recorded against the person signed in, and the Controls report lists reopened bills, bills changed after printing and reprints, each with who approved it.
• Clocking in. Staff clock in and out on the POS's sign-in screen with the same PIN, and the timesheet adds up hours for wages.
• When someone leaves. Remove from team ends their roles, PIN and sign-ins everywhere at once; their name stays on the bills and reports. Bring back returns their roles, with a new PIN.

See staff PINs in depth and the lesson Add your staff and give them a PIN.

Setup checklist

1. Give every person their own PIN; retire any shared login.
2. Assign roles by job, and adjust permissions only where needed.
3. Set discount limits and a small complimentary allowance.
4. Require a manager for voids, comps, cancellations, refunds and payouts.
5. Turn on auto-lock.
6. Remove access the day someone leaves.