Modules & RBAC
Audience: Owner / workspace admin
Objective: Turn on the right modules and assign roles so staff see only what they need.
What it is
- Modules - feature packs (PMS, F&B, CRM, HR, payroll, AI, …) controlled in workspace settings.
- Roles -
admin,manager,cashier,housekeeping. - Permissions - fine-grained capabilities (for example
front_desk,fnb_void,payroll_approve,ai_approve).
Navigation and APIs both enforce access. Client redirects are UX only - the server is authoritative.
Why it exists
A housekeeper should not see payroll runs; a cashier should sell and serve without changing property rates; AI writes need approval.
Role snapshot
| Role | Typical use |
|---|---|
| admin | Full workspace: settings, team, audit, all modules |
| manager | Operations + most configuration; cannot elevate others to admin |
| cashier | Front desk, POS, F&B serve/settle, CRM view (+ limited writes), AI ask, payroll self-service |
| housekeeping | HK tasks / /hk home; not front-desk money flows |
Full matrix: Roles & permissions.
Common misconceptions
- Enabling a module without training still creates risk - pair with Team & roles.
- Housekeeping Hindi UI does not change invoice language.
Where to go next
- Onboarding checklist
- For engineers:
docs/rbac-matrix.md