Roles and permissions (RBAC)

The five tiers

• Owner — full control, including closing the business, handovers and billing
• Admin — everything except destructive tenant lifecycle actions
• Manager — day-to-day operations, catalog, orders, bookings, inventory, customers
• Staff — front-line work: take orders, check guests in, dispense, serve
• Viewer — read-only access for accountants and auditors

How it is enforced

Roles are stored in a dedicated membership table, never on the user profile, and are evaluated by database functions running with elevated privileges. Every policy calls those functions, so a compromised browser session cannot escalate itself.

Delegating ownership

Owners can hand ownership to another admin from the Team page. The handover is written to the retained lifecycle log so it stays provable after the fact.