Restaurant Staff Roles and Permissions: A Practical Setup Guide

In many restaurants everyone uses the same login, or the owner’s account sits open on the counter tablet. It works until something goes wrong: a price changes by mistake, an order disappears, or a former employee can still see today’s sales. Clear staff roles prevent most of this, and they are easier to set up than you might think.

Start with least privilege

The principle is simple: each person gets exactly the access their job needs, and nothing more. It is not about distrust. It limits the damage of honest mistakes and makes it obvious who did what. A typical restaurant needs five roles:

• Manager: menu, prices, branch settings and staff for their own branch.
• Kitchen: seeing incoming orders and updating their status.
• Waiter: tables, taking and following orders, and talking to the kitchen when needed.
• Cashier: payments, receipts and closing orders.
• Courier: assigned deliveries, addresses and delivery status.

QR Menu Manager comes with these five roles, and staff work in the plugin’s own panel. They never see the WordPress admin, which removes a whole class of accidental changes.

Why hiding buttons is not security

A common shortcut is to hide the menu item or button a role should not use. That only changes what people see. Anyone who knows the address of a page, or has a saved link, may still reach it if the server does not check permissions. Real protection happens on the server: every action, such as changing a price or cancelling an order, is checked against the user’s role before it runs. In QR Menu Manager permissions are enforced server-side, so a hidden button is a convenience, not the only lock.

Onboarding new staff

1. Create a personal account for each person, never a shared one.
2. Assign the narrowest role that fits, and only the branch they work in.
3. Walk them through their panel during a quiet shift.
4. Agree who they should ask when they need more access, instead of borrowing a colleague’s login.

Offboarding, the step everyone forgets

When someone leaves, remove or disable their account on their last day, not next month. Change any shared codes they knew, such as a tablet PIN or the Wi-Fi password for staff devices. If a role changes, for example a waiter becomes a manager, update the role rather than creating a second account.

Shared devices without shared logins

Kitchens and counters often share one tablet. That is fine, as long as people log in as themselves or the device uses an account with only the role that station needs. Set the screen to lock after a short idle time, keep the device on a separate staff network if you can, and never save the owner’s password in its browser.

Start this week: list who works where, map each person to one role, and remove any account nobody can explain. A clean setup takes an afternoon and saves many awkward conversations later.