Two ways to log in, one system deciding what you can touch

Two account types, not one

Clicking ＋ Add User asks which kind of account you're creating first, because they work differently underneath: a Business User signs in with an email and password from anywhere and consumes one of the tenant's licensed User Seats; a POS User unlocks a till or warehouse screen with a 6-digit PIN, stays local to the workspace, and doesn't use a seat at all. Both get full name, role, and module access — the login method and licensing are what differ.

Roles come from a fixed list, not free text

You pick a role from a dropdown — you can't type a custom title. Business Users choose from just three: Owner, Admin, or Service User ("standard business access — permissions determined by assigned modules"). POS Users choose from ten, built around shop- floor jobs: Admin, Manager, Master Data Editor, POS Cashier, eCommerce Operator, Warehouse Operator, Finance Officer, Production Operator, Reporting & Analytics, and User Administrator.

Permission overrides sit underneath the role

Role and module access decide the broad shape of an account; a Permission Overrides panel underneath lets you grant or remove individual actions without changing the role itself — the same nine permission groups apply to both account types (Master Data, Transactional/POS, Finance, Administration, and others). Each role applies a sensible default set of these on creation; a ↺ Re-apply from role & modules button resets any manual overrides back to that default if things drift.

Audit Log and unlocking a locked-out account

📋 Audit Log is a searchable record of who did what and when — search by user, action, or details, filter by action type, and ⬇ Export CSV for a compliance request. Up in the header, 🔓 Unlock Account lists anyone currently locked out (too many failed PIN/password attempts) with a one-click 🔓 Unlock — itself logged as its own audit entry.

Office Profile: the business itself

Office Profile is where each physical location's legal details live — name, country (AU/US), tax rate, ABN/EIN, address, logo, and an invoice footer message — with one office flagged Set as Primary/Head Office. A separate Default Tax Rate field acts as the AU GST fallback (10%) when an office doesn't override it, and Workspace Branding controls the accent colour and logo shown across the whole app.

Loyalty, Pricing Tiers, Warehouse, and POS Batch Tracking

Four smaller, single-purpose tabs sit alongside Office Profile: Loyalty Program (points per dollar, points needed per $1 reward, Silver/Gold thresholds), Pricing Tiers (group-level customer discount tiers), Warehouse (WMS) (warehouse name and named receiving/dispatch docks), and POS Batch Tracking (a single toggle that turns on batch/expiry capture at the till). Each has its own Save … button rather than one global save for the whole screen.

ERP Controls: approval thresholds and costing method

This is where the business sets its own guardrails — dollar/percentage limits above which an action needs a second person's approval, and how inventory is costed. Nothing here changes what a role can do (that's Users & Security) — it changes at what size an otherwise-allowed action needs a second look.

License: seats and terminal activations

The License tab shows the subscription Plan and Status, how many User Seats are used versus available (this is what a Business User consumes and a POS User doesn't), and every POS terminal that's ever activated against this tenant — each row fingerprinted to a specific device, with the one you're on now flagged THIS DEVICE.