Restaurant access control down to the single action
Everyone on the floor should be able to do their job and nothing riskier, so authority is granted by role, per action, and every use of it is on the record.
CountStand gives every person exactly the authority their job needs: seven roles from owner to a least-privilege agent, split across fifteen granular permissions like voiding an order, giving a discount or refunding a payment. A manager PIN can approve a sensitive action a junior cannot, and the log keeps both the actor and the approver. Anything that moves money needs a YES-code confirmation first, and all of it is audited.
Authority you can grant, withhold and trace
Roles set the baseline; permissions, overrides and confirmations handle the edges.
Seven roles, real least privilege
Owner, manager, cashier, captain, waiter and kitchen each start with the authority that job needs, and a separate agent role runs on the least privilege of all, so automation can never do more than a person allowed it to.
Fifteen permissions, granted one by one
Voiding an order, giving a discount, taking or refunding a payment, managing the menu, viewing reports, closing the day, each is its own switch, so a waiter can send food without ever touching a refund.
Manager-PIN override, both names logged
When a junior hits a wall, a manager PIN approves the one action on the spot, and the record keeps both the person who did it and the manager who allowed it, so accountability is never blurred.
A YES-code on every money move
Refunds and other cash-moving actions ask for a short YES-code before they run, turning a mis-tap into a deliberate confirmation and leaving a clean line in the audit trail.
How do you stop a waiter from voiding their own tab?
Theft and mistakes in a restaurant rarely need a hack, they need an account that can do too much. If every login can void an order, hand out a discount or open the drawer, a bad night is one tap away and impossible to trace. Access control fixes that by starting each role with the smallest set of powers it needs, and making everything beyond it something a manager has to approve.
The waiter who tries to void their own tab simply cannot, the void permission is not on their role. When a genuine void is needed, they call a manager, whose PIN approves that single action while the log notes who asked and who approved. The result is a floor where juniors move fast inside safe limits, and the few risky actions are rare, deliberate and always attributable to two named people.
Why does moving money need a YES-code as well as a role?
Roles decide who may attempt an action; a YES-code decides that a money move is really meant. The two answer different risks. A cashier is allowed to take and refund payments all shift, that is their job, so a role alone would not stop a fat-fingered ₹4,000 refund. Asking for a short confirmation code at the moment money moves turns an accidental tap into a small, deliberate step nobody takes by reflex.
Underneath both sits one audit trail. Every permission used, every manager override, every YES-code confirmed writes a line that says who, what and when. That record is what turns a dispute at closing, a missing refund, a discount nobody remembers, into a two-minute look rather than an argument. Authority in CountStand is never a vague trust; it is a specific grant, exercised by a named person, and kept.
Asked by owners like you
What roles does CountStand support?
Seven: owner, manager, cashier, captain, waiter, kitchen and a least-privilege agent role for automation. Each begins with the authority its job needs, and you tune the fifteen individual permissions from there.
Can a manager approve an action a staff member can’t do?
Yes. A manager PIN authorises the single sensitive action on the spot, a void or a discount a junior role lacks, and the log records both the staff member who performed it and the manager who approved it.
What is the YES-code for?
It is a short confirmation required before any money-moving action, like a refund, executes. Because roles let cashiers move money all shift, the YES-code is the extra step that separates a deliberate refund from an accidental tap.
Is every action recorded?
Yes. Every permission used, manager override and YES-code confirmation writes a line to the audit trail with who did what and when, so a closing-time dispute becomes a quick look rather than an argument.
Give everyone their job and no more
Roles, overrides and audited money moves on every plan, start a 30-day free trial.
30-day free trial · No card · From ₹999/mo per outlet