Staff overview

How attendance, leave, payroll and advances connect — and the order to do them in.

There are four staff processes, and none of them work alone. Attendance decides how much someone is paid. Leave affects attendance. Advances get deducted from the payslip. Doing these in the wrong order can cost someone money.

What it is

Four screens work together to turn your staff roster into a paid, properly managed workforce: Attendance, Leave Requests, Payroll, and Salary Advances. Underneath all of them sits the staff register — the Users list, where every staff member's profile, pay details, and role are kept — and Roles & Permissions, where an admin decides who is allowed to do what.

• Who uses it — outlet managers run all four screens day to day. Every staff member also has their own view of their attendance, leave, and payslips.
• Where it lives — Payroll, Attendance, and Salary Advances sit together in one admin area. Leave Requests is a separate screen. Both rely on the same staff list (Users) and the same role system (Roles & Permissions).
• Current status — all four processes are live and used every day, but they're all done by hand. There is no automatic monthly payroll run, no automatic syncing between leave and attendance, and no automatic recovery of advances beyond what's described below.

How it works

How they connect

flowchart LR
    B[Leave<br/>requested and approved] --> A[Attendance<br/>marked daily]
    A --> C[Payroll<br/>generated and approved]
    D[Salary advance<br/>approved] --> C
    C --> E[Payslip<br/>staff can view]

The two rules that cause most problems

The safe order

Before any of that — the staff register and roles

Attendance, leave, payroll, and advances all depend on one thing: a staff record with a role attached. That record is created and kept up to date on two screens that sit outside the four processes above, but feed into all of them: the Users list, and Roles & Permissions.

Finding someone on the staff list

Whether someone can see this list at all is controlled by permissions, which an admin manages from Roles & Permissions.

Row actions on each staff card

• Edit (pencil icon) — opens the same tabbed editor described below, plus an eighth Access tab (see Roles & permissions).
• Change Password (key icon) — an admin sets a new password directly. No reset email is sent.
• Archive (box icon, red) — removes the user from the active list. They can no longer log in, but every attendance, leave, payroll and advance record they were part of stays exactly as it was.
• Restore (only shown when Show archived is on) — brings an archived user back.

Archiving is a soft delete, confirmed live: it revokes every one of that user's active sessions immediately, on top of blocking new logins — so a session they're already signed into stops working too, not just future sign-in attempts.

Each of these actions has its own on/off switch in the role editor, so a role can be given, for example, edit access without archive access.

Add User — the six-step wizard

Add User opens a form with six tabs — Basic, Address, Documents, Employment, Pay Config, Roles — that all submit together as one action. There's no save button on each tab; every field from every tab is collected and sent together at the end.

Whenever a new person joins, this is the only way to create their login. Whether someone can even see the Add User button is controlled by permission — a role without that permission never sees the option.

The password has to clear six checks

Every password set anywhere in the system, including here, has to follow the same rules: at least 8 characters, a mix of upper and lower case letters, at least one number, at least one special character, no character repeated 4 times in a row, and no 4-character run like 1234 or abcd. Passwords are also checked against a list of common passwords — even something like password123! is rejected, because stripping the numbers off the end still leaves the common password password.

The role decides whether the Outlet field appears at all

The outlet picker on the Roles tab doesn't always appear, and even when it does, filling it in isn't always required. It depends on who is creating the user, and which role is picked:

Only outlet-level roles can be assigned from this form at all. Creating a second brand-level Super Admin account is blocked outright — both by the form's own list of roles, and, as a backup check, by the system itself. A brand can only ever have one Super Admin.

This matters as soon as a brand runs more than one outlet. Picking the wrong outlet here is how a new waiter can end up unable to see their own till. This rule is checked twice — once when the form is submitted, and again when the account is actually created — so it can't be skipped through any other route into the system.

How it is secured

Every one of the four staff processes, plus the staff list itself, has its own named switch on the Roles & Permissions screen. A role either has that switch turned on or off — having one permission never automatically grants another.

That covers the staff list itself. Each of the four day-to-day processes has its own separate switches:

Who holds what, by default

The system comes with four roles: Super Admin (one per brand), Outlet Manager, Waiter, and Delivery Rider. Here's what each one can do by default:

Tenancy — one outlet at a time

A staff member's attendance, leave requests, payroll records, and salary advances all belong to a single outlet. None of these records separately track which brand that outlet belongs to — the system only knows the brand through the outlet itself. In practice, this means all four screens are reviewed and approved one outlet at a time. There is no single combined view covering every outlet a brand owns.

Related pages