Restaurant Operations
Restaurant Staff Roles and Permissions: Who Should See What
Give every person their own sign-in and a role that matches the job. A server needs the orders and the tables, the kitchen needs the tickets, a cashier needs the bills. Refunds, menu prices, reports and staff settings should stay with the owner or a manager. When something goes wrong, you can then see who did it, and you can take one person's access away without changing everyone's.
Why one shared login is a risk
Many small restaurants run on one password that everybody knows. It is quick on day one and expensive later.
- You cannot tell who did what. A refund, a cancelled order or a changed price has no name on it.
- You cannot take access away from one person. When someone leaves, the only fix is to change the password for everyone.
- Everybody can do everything. The new hire on a Saturday night can reach the same settings as the owner.
- The password travels. It ends up on a sticky note, in a group chat or with a former employee.
Typical restaurant roles
Most restaurants need only a handful of roles. Start from these and adjust them to how your team actually works.
| Role | Usually needs | Usually does not need |
|---|---|---|
| Manager | Everything on the floor and in the kitchen, plus the day's numbers | Owner-level settings, such as payouts or staff pay |
| Assistant manager | The floor and the kitchen, plus a look at the day's numbers | Menu prices and staff settings |
| Server | Orders, order status, waiter calls and closing a table's bill | Reports, menu edits, refunds |
| Cashier | Orders and closing bills | Changing order status in the kitchen, menu edits |
| Kitchen | Incoming orders and moving them from preparing to ready | Bills, payments and reports |
Permissions that matter most
A few actions deserve extra care, because they move money or change what guests see:
- Refunds and voids. Money leaves the business. Keep them with the owner or one trusted manager, and check them on the end-of-day report.
- Discounts and promo codes. A discount is a sale you give away. Decide who may apply one, and look at how often codes are used.
- Menu edits and prices. One wrong price is charged on every order until someone notices. Marking a dish sold out is different: the floor and the kitchen should be able to do that at once.
- Reports. Sales figures are sensitive. Share them with the people who act on them.
- Staff settings. Who can add people, change roles or reset a PIN decides everything else on this list.
For what to check on that nightly report, see the restaurant end-of-day report.
Sign-in on shared devices
Many people share a kitchen screen or a tablet at the pass in one shift. A full password on a busy line is slow, so most restaurants use a short personal PIN instead. A few habits keep that safe:
- Give each person their own PIN. Never share one PIN for a whole shift.
- Make sure repeated wrong PINs lock sign-in for a while, so nobody can guess their way in.
- Switch off a person's access on their last day, before they leave the building.
- Look at each role again when the menu, the floor or the team changes.
Roles with Thmenu
In the Thmenu panel you create roles and add your staff to them. Each role is a set of permissions: PIN sign-in, view orders, update order status, manage waiter calls, close bill, manage menu and view analytics. You can start from the presets for waiter, cashier, kitchen, assistant manager and manager, then add or remove any permission. A person whose role has no PIN sign-in cannot sign in at all.
Staff sign in on the kitchen screen with a personal PIN of 4 to 6 digits. On the kitchen screen the role decides two things, checked on every action: who may see orders and who may move them along. Manage waiter calls, close bill and manage menu can be set in the role editor, but the kitchen screen does not use them, so today they do not change what a person can do there. If you turn a person off, or take sign-in away from their role, their access stops on the next action. After 10 wrong PINs within 30 minutes, PIN sign-in for your restaurant is locked until the 30 minutes have passed.
One thing to know before you hand out PINs: the kitchen screen shows a live tile for today with the number of orders, the revenue so far and the average prep time, to everyone whose role can view orders. Every preset can view orders, so your kitchen and cashier staff see today's revenue too. View analytics does not change this, and does not open any report for staff.
Refunds, full menu editing, the full reports, settings and the staff list itself stay in your own panel login. Staff who sign in with a PIN reach the kitchen screen, not those pages, and no staff role can issue a refund.
If your team shares tips, see how restaurant tip pools work.