Role
A named bundle of capabilities that corresponds to a job — counter staff, delivery member, manager, admin, owner. One role per job, never one per person. People are assigned to roles; roles are granted capabilities.
Why it matters in practice. Role sprawl is the normal failure mode: a role created per person to solve one problem leaves a workspace with forty roles nobody can describe. A role whose description cannot be written in a sentence is a role to collapse.
Often confused with Capability, Permission, Shared login.
Capability
A single thing a person may do in the system — create a company, create a quote, create an invoice, record a payment, update a task, change task status, manage project members. Capabilities are the atoms that roles are made of.
Why it matters in practice. Granting capabilities to a role, rather than checking a role name inside the code, is what lets a supervisor be added as a data change rather than a release, and a role be renamed without behaviour moving underneath it.
Often confused with Permission, Role, Threshold approval.
Permission
A capability evaluated in a scope: may this person, in this workspace or branch, perform this action. Permissions decide what is possible — not what is expected, and not what is convenient at a busy counter.
Why it matters in practice. It is the reason a delivery role can read the client and project context without being able to raise a money document against it. Quotes, invoices, payments, and discount approval are separate, explicit permissions rather than consequences of being an employee.
Often confused with Capability, Permission scope, Threshold approval.
Permission scope
The boundary a permission is enforced inside — a workspace, a branch, a store, a team. The same person can hold different capabilities in two branches without holding two identities, which is what makes scoping different from duplicating accounts.
Why it matters in practice. Scope is what makes multi-site control possible at all: a group of counters is not one all-or-nothing switch, and a consolidated view can read from the same records rather than from a monthly export that is always slightly out of date.
Often confused with Permission, Multi-location stock, Least privilege.
Threshold approval
A rule that lets an action proceed within a stated limit and turns anything beyond it into a recorded request: a value, a reason, a requester, and a separate named approver. It answers "may they do it this time, this large, in this situation".
Why it matters in practice. Thresholds are a different concern from permissions. Expressed as permissions, you end up with roles named "discount-up-to-ten-percent" and a role per person per limit. The approval path is where the exception becomes reviewable instead of invisible.
Often confused with Permission, Override, Separation of duties.
Override
A supervisor acting past a control that would otherwise block the action, recorded with who did it, when, and against what. The important property is not that overrides exist — they often must — but that they are recorded.
Why it matters in practice. An unrecorded override is functionally identical to no control at all. Recorded, it becomes a reviewable exception, and the ability to read those overrides is itself a permission that should be genuinely narrow.
Often confused with Threshold approval, Audit trail, Separation of duties.
Audit trail
The history of who acted, in which workspace and branch, on which record, what changed, and when — including manager approvals and supervisor overrides. It is what you consult after the fact, rather than a control that prevents the act in the first place.
Why it matters in practice. Permissions restrict what can happen; the audit trail is what lets you find out what did. A permission system with no readable log is a speed bump rather than a control, and whoever can read the log can see the shape of the business's weak points.
Often confused with Override, Day-end close, Shared login.
PIN access
Staff signing in on a shared counter or field device with a short personal code tied to their own person record, rather than with a full account and password. The person is the identity; the till is only the device.
Why it matters in practice. It is what makes a shift, a scan, or a counter action attributable to a human rather than to a session. It is also policy-dependent: a PIN on a sticker beside the till is not access control, and two staff sharing a PIN reintroduces exactly the problem it solved.
Often confused with Shared login, Audit trail, Least privilege.
Shared login
One credential used by several people, usually because requiring individual accounts at a busy counter felt like friction. Every action then belongs to the account rather than to the human who took it.
Why it matters in practice. It defeats the counter shift record and makes a resignation impossible to handle cleanly, because you cannot tell which of the departing person's actions were theirs. It also usually comes back, because the credential policy gets written later than the PIN.
Often confused with PIN access, Audit trail, Role.
Separation of duties
The rule that the person who raises an exception is not the person who approves it, enforced in the system rather than left to convention. The requester and the approver are separate, recorded fields.
Why it matters in practice. Self-approval is the exception most likely to be requested and the one most likely to be granted for convenience, which is exactly why it belongs in the model rather than in the org chart. A rejected request should also leave the underlying record untouched.
Often confused with Threshold approval, Override, Least privilege.
Least privilege
The default that a person can do only what their job actually requires, with anything beyond that granted explicitly and reviewed when the job changes rather than when something breaks.
Why it matters in practice. Doing it is uncomfortable work, because the person who set the system up is often the person who knows the most and the one who would lose access. That is a reason to write the roles down and transfer what only they know before applying them, not a reason to skip the step.
Often confused with Role, Capability, Shared login.