The instinct when setting up staff access is to think about trust. It is the wrong starting point, and it makes the conversation personal when it does not need to be. Start from the job instead: what does somebody standing at that counter actually need in order to do their work well?
The three views
| Cashier | Manager | Owner | |
|---|---|---|---|
| Raise bills, take payment | Yes | Yes | Yes |
| See stock levels | Yes | Yes | Yes |
| See cost price and margin | No | Usually not | Yes |
| Give discounts | Within a limit, or not at all | Yes | Yes |
| Cancel a bill | No, or with a reason recorded | Yes, with a reason | Yes |
| Add or change products and prices | No | Yes | Yes |
| See customer khata balances | Yes — needed to serve them | Yes | Yes |
| Raise purchase orders | No | Yes | Yes |
| Approve purchase orders | No | Sometimes | Yes |
| See overall reports and profit | No | Sales, not profit | Yes |
| Manage other staff | No | Sometimes | Yes |
Nothing in the cashier column is a statement about the person. It is a description of what billing requires. A cashier with no access to cost prices can do every part of their job without difficulty, which is the test that matters.
Why cost price is the one to be careful with
Your buying prices are among the very few genuinely confidential pieces of information in a small shop. They tell a competitor what terms you have, they tell a customer how much room there is to negotiate, and they can make a staff member's own wage feel like a different number than it did yesterday. None of those conversations improve your shop, and none of them are necessary for anybody to sell anything.
The mistake in the other direction
Restricting everything to yourself is a real cost, and it is the more common failure among shopkeepers who have been running alone for years. If nobody can raise a purchase order, adjust stock or deal with a supplier, then you cannot be ill, cannot travel, and cannot take a day off — and the shop's capacity is permanently capped at what one person can personally handle.
One person with a manager's access, chosen deliberately, is what buys back that flexibility. They do not need to see profit to run the shop for a week.
Names matter more than locks
If there is one thing to take from this, it is not the permission table. It is that every person should have their own login.
- A bill with a name attached can be asked about. A bill from a shared account cannot.
- Most problems are mistakes, and a mistake you can trace is a mistake somebody can explain and stop repeating.
- People are noticeably more careful when their name is on the entry, which does more for accuracy than any restriction.
- When somebody leaves, one account is disabled — rather than a shared password being changed and told to everybody again.
Permissions decide what can happen. Names decide whether anybody can find out what did.