Access (groups & policies)

GreenSails lets you decide who can do what, and often at which locations. It sits on top of member base roles: roles set the baseline, while policies and groups add the details.

The building blocks

The Access page has two tabs, Groups (default) and Policies. Create policies first, attach them to groups, then add members to those groups. For one-off grants, skip the group and attach policies directly to the member.

Base roles first

Before groups and policies, each member has a base role:

How policies work

A policy contains one or more statements. Each statement has:

• Effect: Allow or Deny
• Actions: Specific permissions (e.g. orders:view, menu-boards:manage) or * for every action
• Locations: For location-scoped actions, which venues the statement applies to (All locations or a picked subset). Ignored for org-wide actions.

When you edit a policy, the statement editor groups actions the same way as the product UI (Organization, Members, Inventory Items, Stock Taking, Orders, and so on).

Location scoping

Only certain permissions can be limited to specific locations. For everything else, location picks in a statement are ignored and the grant applies organization-wide.

Location-scoped (you can restrict to selected venues):

Organization-wide (location scope has no effect):

• Catalog: items, item categories, modifier groups, location categories, locations:create
• Stock taking & intelligence: stock-taking:*, inventory-alerts:*, inventory-reports:view
• Billing: all invoices:* and contracts:* actions
• Administration: members, service accounts, settings, audit logs, access control, org settings
• Other: menu-boards:manage, shifts:view, uploads:create

Example: a regional supervisor might get orders:view and menu-boards:set-availability at three stores only. An invoice clerk gets invoices:* org-wide with no location picker.

Permission reference

The tables below mirror the action picker in the policy editor. Grant the minimum set each role needs.

Organization & administration

Catalog

Inventory operations

See Inventory Overview, Vendors, Purchase orders, and Transfers for how these map to the sidebar.

Sell & kitchen

Workforce

Workforce permissions split manager tools in the dashboard from self-service tools in the staff portal:

See Workforce Overview and Staff Portal.

Billing & money

Invoice and contract actions are organization-wide:

Grant send separately from update when staff may prepare documents but only managers may deliver them.

Analytics

Groups: manage access at scale

A group bundles policies under a name like "Store Managers" or "Menu Editors." Assign members to the group and they inherit every attached policy. When responsibilities change, edit the group once instead of each member.

Per-member access

For one-off needs, open Settings → Organization → Members, click Manage access on a row, and attach groups or individual policies without creating a dedicated group.

System presets

Every new organization is seeded with built-in system policies and groups. System policies show a System badge, are read-only, and cannot be deleted, duplicate their intent in a custom policy if you need changes.

System policies

System groups

Attach KitchenDisplay, MemberManager, or StaffPortal policies directly to members or add them to custom groups when needed. There is no preset group for kitchen display operators.

How access is evaluated

When a member attempts an action, GreenSails combines:

1. Their base role baseline (Admin/Member/Service additions; Owner bypasses checks)
2. All policies on groups they belong to
3. Policies attached directly to the member

The engine merges allows and denies, applies deny-overrides-allow, and checks location scope for location-bound permissions. Changes to roles, groups, or policies bump a permissions version so dashboard sessions and terminals pick up new access promptly.

What's next