The problem
With only 3 roles (admin, cashier, kitchen), the account owner was responsible for everything. Once we added accounting, payroll, and purchases, that stopped being practical — or safe.
The solution: real RBAC
Mizan now has a two-layer permission system:
- Tenant layer: the permission only works if the client is contracted for the module. A client without HR contract sees zero hr.* permissions anywhere.
- User layer: union of group permissions + per-user grants/denies.
The 8 built-in groups
- Account Owner — everything
- General Manager — everything except sensitive settings
- Accountant — accounting + purchases + reports
- HR Manager — HR only
- Sales Manager — POS + orders + customers
- Cashier — POS only
- Kitchen — KDS only
- Warehouse — inventory + logistics
Custom groups
Need an "Assistant Accountant" group with read-only access to journal entries but no posting rights? Create it in two minutes.
Safety wins
Grant a cashier "view financial reports" via override — but the client isn't contracted for accounting → request is denied at the tenant layer. Safety beats flexibility.