Managing roles from the console
The console manages roles, assignments, scopes and individual exceptions through four sections.
| Section | What it lets you do | Required permissions |
|---|---|---|
| Role catalogue | View, create, edit and delete role definitions — their name and the permissions they include | roles:read / roles:write |
| Assignments | Assign and unassign roles to employees, activate and deactivate them | employees:read / employees:write |
| Scope | Configure what data each employee can access — brands, stores, sources | employees:read / employees:write |
| Exceptions | Create individual grants or denies on a specific permission for an employee, with an optional expiry date | employees:read / employees:write |
Who can reach each section
Role catalogue is restricted to super_admin — PizzaGest's own technical role. Creating or changing a role definition goes through the development team, who review the change before applying it. See Requesting a new or changed role.
Assignments, Scope and Exceptions are available to admin and employee_manager. These are the three you will use day to day: assigning existing roles, setting scope, and managing exceptions.
This split is deliberate. Changing what a role means affects every employee holding it, across the whole chain — so it is reviewed. Changing who holds a role affects one person, and is yours to do directly.
Assigning a role to an employee
- Open Assignments.
- Find the employee.
- Add the role or roles they need — see The role catalogue and Common role combinations.
- Confirm their scope separately, under Scope. A new role does not change existing scope.
An assignment can be deactivated rather than removed, which keeps the record while suspending the access.
Assigning a role does not give someone a way to sign in. Setting or resetting their password is a separate task, done from the Employees screen — see Employees - Password.
Safeguards
These protect you from the changes that are hardest to undo:
- A role with active assignments cannot be deleted.
- Permissions attached to a role are validated against the system permission catalogue, so a typo can't create a permission that does nothing.
- Every assignment and every exception records who created it, for auditing.
- Individual denies always override what a role grants.
Related pages
- Setting an employee's scope — the three dimensions in practice
- Individual permission exceptions — grants and denies
- Requesting a new or changed role — when no combination fits