Roles & permissions¶
Every person in Zitlin carries one role. It decides which screens they can open and which actions they can take — and, once staff sign-in is on, it is the signed-in person's role that counts, not the account the device is signed in as.
The same seven roles apply to both kinds of access: a Team account signing in from their own laptop, and a Staff member punching a PIN at the front desk.
The seven roles¶
They form a ladder. Each role reaches everything the roles below it reach, plus more:
| Role | Sits at | In one line |
|---|---|---|
| Admin | the top | Everything, including settings, taxes, team and the staff roster. |
| Accountant | below Admin | Everything operational, plus invoicing, expenses, rates and reports. |
| Rooms Manager | below Accountant | The rooms side end to end: bookings, rates, channel manager, night audit. |
| Front Desk | below Rooms Manager | The daily desk job: book, check in and out, take prepayments and deposits, settle bills. |
| Restaurant Manager | below Front Desk | The restaurant: tables, orders and food bills. |
| Waiter | below Restaurant Manager | Take orders and settle table bills. |
| Housekeeping | at the bottom | The housekeeping board. |
It is a ladder, not two columns
Restaurant Manager and Waiter sit below Front Desk rather than beside it, so anyone on the rooms side can also work the restaurant — a Rooms Manager can raise a kitchen order. It does not run the other way: a Restaurant Manager can see the booking list but cannot check a guest in or take a room deposit.
Give someone who genuinely runs both sides an Accountant or Admin role.
What each role can reach¶
Because the roles nest, this table gives the lowest role that can do each thing. Everyone above that row's role can do it too.
Bookings and guests¶
| Action | Lowest role |
|---|---|
| See the booking list, a folio, and availability | Restaurant Manager |
| Create and edit a booking | Front Desk |
| Check in and check out | Front Desk |
| Assign and move rooms | Front Desk |
| Add and edit guests | Front Desk |
| Attach or replace a guest's ID photo | Front Desk |
| View a stored ID photo | Front Desk |
| Add booking extras | Front Desk |
| Revert a check-in or check-out | Accountant |
| Remove a stored ID photo | Rooms Manager |
| Cancel or delete a booking | Rooms Manager |
| Override a nightly rate | Rooms Manager |
| Block dates on a room | Rooms Manager |
| Delete a guest | Accountant |
Money¶
| Action | Lowest role |
|---|---|
| Record a prepayment, or correct one | Front Desk |
| Take a security deposit, or return one | Front Desk |
| Raise a room bill | Front Desk |
| Settle a bill | Waiter |
| Open and close your own cash drawer | Waiter |
| Review other people's drawer counts | Restaurant Manager |
| Force-close somebody else's drawer | Admin |
| Edit a bill | Accountant |
| Record expenses, and manage vendors | Accountant |
| Void a bill | Admin |
Settling is narrowed by what kind of bill it is
Anyone who can hold a drawer may settle, but only for the bills they actually work:
- Restaurant bills — Waiter and above.
- Room and room-service bills — Front Desk and above.
- Event space bills — Accountant and above.
A waiter settling a table bill is normal; the same waiter cannot open a room bill at all.
Drawer history skips Front Desk on purpose
"Which of my colleagues came up short last Tuesday" is a supervisor's question, and a front desk clerk holding a till of their own is exactly who it is being asked about. Reviewing other people's counts is therefore Admin, Accountant, Rooms Manager and Restaurant Manager — Front Desk is left out even though it sits higher on the ladder than Restaurant Manager. It is the one place the ladder is broken deliberately.
Restaurant¶
| Action | Lowest role |
|---|---|
| Take an order, change a table | Waiter |
| See and create table reservations | Waiter |
| Edit or cancel a table reservation | Restaurant Manager |
| Raise a food bill | Waiter |
| Mark an item complimentary | Restaurant Manager |
| Edit the menu and categories | Accountant |
A waiter marking an item complimentary is not refused
Comping is effectively a discount, so it stays a Restaurant Manager power — but the order still goes through, just without the flag. Zitlin drops the field rather than rejecting the whole ticket over it. Nightly rate overrides work the same way for Front Desk.
Housekeeping¶
| Action | Lowest role |
|---|---|
| See the board, pick up and complete tasks | Housekeeping |
| Create and assign tasks | Housekeeping |
| Set room status | Housekeeping |
Reports and closing the day¶
What each report covers is in Reports.
| Action | Lowest role |
|---|---|
| Housekeeping report | Housekeeping |
| Food and breakfast reports | Restaurant Manager |
| Occupancy and exceptions reports | Rooms Manager |
| Night audit — checklist, no-shows, close the day | Rooms Manager |
| Revenue, finance, folios, channel mix, expense reports | Accountant |
| Audit log | Accountant |
| Re-open a closed day | Admin |
Setup¶
| Action | Lowest role |
|---|---|
| Channel manager and OTA calendars | Rooms Manager |
| Inventory — see stock, record movements | Rooms Manager |
| Create and edit stock items | Accountant |
| Rate plans, seasonal and weekday overrides, restrictions | Accountant |
| Rooms, room types and extras | Accountant |
| Event space bookings | Accountant |
| Define the event spaces themselves | Admin |
| Taxes | Admin |
| Property settings | Admin |
| Team accounts and the staff roster | Admin |
Reading is not writing¶
Two rules run through the whole table:
Viewing stays open. When staff sign-in is required, only changes need somebody signed in. An unattended terminal still shows the board, so the person walking past can see tonight's arrivals without punching a PIN.
Money asks twice. A short list of actions re-prompt for the PIN even mid-shift, once it has gone stale — settling, voiding, editing a bill, overriding a rate, cancelling a booking, recording a prepayment, taking or returning a security deposit, reverting a check-in, and closing a drawer. See Re-confirming a PIN.
And so does a guest's ID. Opening or removing a stored ID photo asks the same way. It is not money, but it is the other thing in Zitlin worth stopping somebody for — and it means the record of who looked names a person rather than a tablet.
Common questions¶
Can I give someone a custom set of permissions?
No. Roles are fixed, and deliberately few — a per-person permission matrix is a support burden that small properties end up misconfiguring. Pick the closest role; if somebody genuinely spans two sides of the property, Accountant is usually the right answer.
Why can a Rooms Manager work the restaurant but not the other way round?
Because rooms is the larger job. Somebody trusted with rates, the channel manager and the night audit is trusted to send a plate of food to the kitchen. The reverse is not true: a Restaurant Manager has no reason to be checking guests in or handling room deposits.
The person is signed in but a screen is still refused
Check whose role is being used. Once Require staff sign-in is on, the device account's role stops counting entirely — an Admin tablet with a Waiter punched in behaves as a Waiter. The shift banner across the top names whoever is currently on.
Someone changed role — do they need to sign out?
No. The role is read fresh on every action, so a change takes effect immediately — including mid-shift, without them signing out. The screens the app shows them refresh the next time it reloads their details.