Access Control — SOP
How this module works — Generated 26 Sep 2026
Lets the owner define which of the app's 42 modules each role (Owner, Manager, Staff) is intended to access, and set an optional 4-digit PIN to lock specific sensitive pages. Honest note: right now this page is a settings-and-audit-trail tool — it records what access SHOULD look like and logs every change, but toggling a module here does not yet stop anyone from opening it elsewhere in the app. Real enforcement (checking these settings before a Manager or Staff session can load a page) is a separate, not-yet-built project.
Sections
👥 Role Matrix
Owner, Manager and Staff each get their own list of all 42 modules with an On/Off switch per module, grouped by category (Dashboard, Sales, Finance, AI Tools, Team, System).
🔒 Owner PIN Lock
An optional 4-digit PIN, with automatic lockout after 5 wrong attempts. Choose which pages ask for it.
📊 Compare View
A side-by-side table of every module against Manager and Staff, so differences are easy to scan at a glance.
📜 Recent Changes
A running log of the last few permission edits, who made them, and when.
🗺️ Security Roadmap
A preview of what is planned next for this module, including real enforcement (see the Overview note above).
Step-by-Step Workflow
1
Pick a role (Owner, Manager or Staff) from the left list — Owner always has full access and cannot be changed.
2
Toggle any module On or Off for that role, or use a category's All On / All Off buttons to flip a whole group at once.
3
Every change saves instantly and appears in Recent Changes below — there is no separate Save button for the matrix.
4
Use Compare to see Manager and Staff side by side for every module in one table.
5
Optionally set a 4-digit Owner PIN and choose which pages should ask for it before opening.
6
Reset to defaults restores a role's original recommended module list at any time.
Connections
🔗 None yet
This is an honest gap, not an oversight: no other module currently reads these permission settings. A role's module list here does not change what that role can actually open anywhere else in the app today. Wiring real enforcement is tracked as a future project.