Advanced Permissions — cashiers should not see payroll

The problem

With only 3 roles (admin, cashier, kitchen), the account owner was responsible for everything. Once we added accounting, payroll, and purchases, that stopped being practical — or safe.

The solution: real RBAC

Mizan now has a two-layer permission system:

1. Tenant layer: the permission only works if the client is contracted for the module. A client without HR contract sees zero hr.* permissions anywhere.
2. User layer: union of group permissions + per-user grants/denies.

The 8 built-in groups

• Account Owner — everything
• General Manager — everything except sensitive settings
• Accountant — accounting + purchases + reports
• HR Manager — HR only
• Sales Manager — POS + orders + customers
• Cashier — POS only
• Kitchen — KDS only
• Warehouse — inventory + logistics

Custom groups

Need an "Assistant Accountant" group with read-only access to journal entries but no posting rights? Create it in two minutes.

Safety wins

Grant a cashier "view financial reports" via override — but the client isn't contracted for accounting → request is denied at the tenant layer. Safety beats flexibility.