> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tillbiz.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles & permissions

> Control exactly what each staff member can see and do across your business.

**Roles** bundle **permissions** together so you can give each staff member the
right level of access. TillBiz ships with sensible defaults, and you can create
your own roles and fine-tune individual permissions.

## Default roles

| Role              | Typical access                                                |
| ----------------- | ------------------------------------------------------------- |
| **Admin / Owner** | Everything — settings, billing, all stores                    |
| **Manager**       | Day-to-day operations: catalog, inventory, reports, approvals |
| **Cashier**       | The till: shifts, orders, payments                            |

## How permissions work

A permission grants the ability to do one thing — for example *create orders*,
*refund payments*, or *view reports*. Many permissions come in **two scopes**:

* **Own** — act on records you created (e.g. a cashier sees only *their* orders).
* **All** — act on everything in the store (e.g. a manager sees *all* orders).

This is why a cashier and a manager can both open the Orders page but see very
different lists.

## Create or edit a role

<Steps>
  <Step title="Open Roles">
    Go to **Settings → Roles**.
  </Step>

  <Step title="Create a role">
    Click **New role**, name it, and tick the permissions it should include.
  </Step>

  <Step title="Assign it">
    Set the role on a [user](/guides/settings/users).
  </Step>
</Steps>

## Per-user overrides

You can grant or remove **individual permissions** for a single user on top of
their role — handy for temporarily letting a senior cashier approve refunds.
Overrides can be set to **expire** on a date.

<Tip>
  Follow the principle of least privilege: give each role only what it needs.
  It keeps your business secure and your [audit log](/guides/settings/audit-logs)
  meaningful.
</Tip>