How roles and permissions work in Salon Booking OS
9 min read
Everything in Salon Booking OS by OsDotâ„¢ is denied unless a role allows it. Roles hold permissions; pages, buttons and API operations check the permission, never the role’s name. The owner role is the only one that holds every permission.
Video tutorial #
How to give your team sign-ins and permissions in Salon Booking OS by OsDotâ„¢ 1.0.0
The four roles #
| Role | Holds on a new installation | In short |
|---|---|---|
| Owner | every permission, now and when new ones are added | The installation’s owner, created by the installer. Owner-only settings ask for the password again (see First admin and configuration). |
| Manager / Front desk | 21 permissions (marked “Manager” in the table below) | Runs the calendar for every staff member, the clients, orders and payments, the shop’s orders, returns and stock, and the messages. |
| Staff | 3 permissions: See own bookings and own calendar, Start walk-in appointments, Mark confirmed by phone, arrived, started, completed or no-show | Works with their own appointments. |
| Client | no permission | Every client’s account has this role. Clients act only on their own records and never see the administration area. |
Visitors who are not signed in and the scheduled tasks are not roles you assign.
Giving your team their sign-ins #
Each member of your team gets their own sign-in: under People → Add a staff member you give their name, their roles and an e-mail address — or, for someone without e-mail, a sign-in name — and hand over the setup link. To show them their own appointments, link their sign-in to their staff record on Salon → Staff sign-in (below). The full steps are in Your team’s sign-ins.
Changing what a role may do #
What each role may do is the owner’s to decide, on People → Roles and permissions. Only the owner opens this page.
- Open People → Roles and permissions. Each role shows how many permissions it holds; the owner’s role shows “Full access: every permission” and is not changed here.
- Open a role. Its permissions are listed in groups — AI writing helper, Audit log, Bookings, Services and prices, Clients, Website, Payments, Messages, Licensing, Reports, Working hours and closures, Settings, Shop, Staff, Appearance — each with its description and its code.
- Tick what the role may do, untick what it may not, and choose Save the permissions. Saving asks for your password again unless you signed in or confirmed it in the last 10 minutes (see First admin and configuration); what you ticked is kept and saved right after.
Each permission granted or withdrawn is written to the audit log. A permission you take away stays away when the site is updated. The table below shows what each permission opens and what a new installation starts with.
For example, give the manager / front desk Add and remove closures and holidays, Change business settings delegated by the owner or See reports.
The Client role’s page warns you that it is the clients’ role: anything ticked there reaches every client’s account. Leave it without permissions.
The permissions #
Grouped as on the roles page. “Manager” is the Manager / Front desk role.
| Group | Permission (code) | What it opens | Held on a new installation |
|---|---|---|---|
| AI writing helper | Use the AI writing helper (ai.use) | nothing in this version | Owner |
| Audit log | See the audit log (audit.view) | System → Audit log | Owner, Manager |
| Bookings | See every booking and the calendar of every staff member (booking.view.all) | Front desk → Calendar, Find an appointment, Call-backs and, with the status marks, End of day; every staff member’s schedule to read (Salon → Hours, staff and services, Salon → Staff) | Owner, Manager |
| Bookings | See own bookings and own calendar (booking.view.own) | My day and My schedule; for an account without the permission above, the Calendar and Find an appointment with its own appointments — each once the sign-in is linked to a staff member | Owner, Manager, Staff |
| Bookings | Create desk and phone bookings (booking.create.desk) | New booking; the staff-side search for free times and who is free now | Owner, Manager |
| Bookings | Start walk-in appointments (booking.create.walkin) | Walk-in | Owner, Manager, Staff |
| Bookings | Move bookings (reschedule) (booking.move) | moving an appointment (drag on the calendar, or the Move form) | Owner, Manager |
| Bookings | Cancel bookings (booking.cancel) | cancelling an appointment | Owner, Manager |
| Bookings | Override soft booking rules (audited) (booking.override.soft) | “Book it anyway?” with a written reason | Owner, Manager |
| Bookings | Mark confirmed by phone, arrived, started, completed or no-show (booking.status.mark) | the status buttons on the appointments the account can see | Owner, Manager, Staff |
| Bookings | Reassign bookings to another staff member (booking.reassign) | Give a service to someone else | Owner, Manager |
| Bookings | Reopen a completed booking or revert a no-show the same day, cancel after arrival, waive a kept deposit (audited) (booking.manage) | Reopen, Revert the no-show, a cancellation after arrival, waiving a kept deposit | Owner, Manager |
| Services and prices | Edit services, categories, options and prices (catalogue.edit) | Salon → Services | Owner |
| Clients | See client records (client.view) | Clients: the list and each client’s page (what the page shows of visits, orders and messages follows the account’s other permissions) | Owner, Manager |
| Clients | See client phone numbers and e-mail addresses (client.contacts.view) | phone and e-mail on appointments; tap-to-call on the call-back list and in My day | Owner, Manager |
| Clients | See the addresses of home visits (client.addresses.view) | the client’s address on a home visit (the staff member assigned to the visit sees it anyway) | Owner, Manager |
| Clients | Edit client records (client.edit) | Stop messages and Allow messages for an address on a client’s page | Owner, Manager |
| Clients | Import clients from CSV (client.import) | nothing in this version | Owner |
| Clients | Download a client’s data (client.export) | Download the client’s data on a client’s page | Owner |
| Website | Edit website pages, blog, menus, homepage sections and gallery (cms.edit) | the Website group (Homepage, Pages, Blog, FAQs, Menus, Legal pages, Business profile, Brand, Enquiries) and uploading to the Media library | Owner |
| Payments | See orders and payments (commerce.orders) | Payments → Orders and Reconciliation | Owner, Manager |
| Payments | Record a payment taken at the salon (commerce.record) | Record a payment taken in person on an order | Owner, Manager |
| Payments | Refund payments (commerce.refund) | Refund on an order; the refund of a shop return, and cancelling a paid shop order | Owner |
| Payments | Manage discount codes and sale prices (commerce.discounts) | Payments → Discounts | Owner |
| Payments | Manage tax classes and rates (commerce.taxes) | Payments → Taxes | Owner |
| Messages | See the messages sent to clients and whether they arrived (communication.messages) | Messages (see Messages, reminders, text messages and push) | Owner, Manager |
| Licensing | Manage the software license (licensing.manage) | System → Software license, in the edition activated with a license key; in other editions nothing | Owner |
| Reports | See reports (reports.view) | Reports: the salon’s month in numbers (see Reports) | Owner |
| Working hours and closures | Add and remove closures and holidays (schedule.closures.edit) | Salon → Closures and holidays | Owner |
| Working hours and closures | Edit every staff member’s working hours and closures (schedule.edit.all) | every staff member’s working hours, breaks, time off and one-off changes (Salon → Staff → Schedule). It does not open Closures and holidays: that page needs one of the two settings permissions named there | Owner |
| Working hours and closures | Edit own working hours (schedule.edit.own) | nothing in this version | Owner |
| Working hours and closures | Add and remove staff time off (schedule.timeoff.edit) | Salon → Staff and every staff member’s schedule, to read. In this version the schedule page shows the time-off form only to a role that also holds Edit every staff member’s working hours and closures | Owner |
| Settings | Change business settings delegated by the owner (settings.business) | Salon → Business hours, Closures and holidays, Location, Home visits, Business settings; Front desk → Reminders | Owner |
| Settings | Change payment gateways and the deposit policy (settings.payments) | nothing in this version | Owner |
| Settings | Change the SMS setup, routes, spending cap and country allowlist (settings.sms) | nothing in this version | Owner |
| Settings | Change integrations and provider keys (settings.integrations) | nothing in this version | Owner |
| Shop | Edit shop products, categories and sale prices (shop.catalogue) | Shop → Products and Categories | Owner |
| Shop | Adjust shop stock (shop.stock) | Shop → Stock | Owner, Manager |
| Shop | See and fulfil shop orders (shop.orders) | Shop → Shop orders | Owner, Manager |
| Shop | Accept, reject and receive shop returns (shop.returns) | Shop → Returns (the refund needs Refund payments) | Owner, Manager |
| Shop | Change shop delivery and pickup (shop.settings) | Shop → Delivery | Owner |
| Shop | See shop reports (shop.reports) | Shop → Shop reports | Owner |
| Staff | Manage staff members (staff.manage) | Salon → Staff (adding and editing staff members) and Staff sign-in; People → People (with Add a staff member, New setup link, an account’s roles and state), Team and Deletion requests (with Complete the deletion) | Owner |
| Appearance | Change the website theme, appearance, motion level and image slots (theme.manage) | the Appearance group (Themes, Colours and mode, Typography, Layout and motion, Images) and the media library’s owner tasks (every file, the logo and the site icon) | Owner |
Six permissions open nothing in this version: Use the AI writing helper, Import clients from CSV, Edit own working hours, Change payment gateways and the deposit policy, Change the SMS setup, routes, spending cap and country allowlist and Change integrations and provider keys. They are listed on the roles page, but giving one to a role changes nothing.
Pages that stay with the owner whatever a role is given: Overview, Get started, Front desk → Online booking, People → Roles and permissions, and in System: Website settings, E-mail (SMTP), SMS (text messages), Push notifications, Stripe, PayPal, Razorpay, Payment options, Google sign-in, About this software, Licences, Before you go live and Updates. The booking rules the owner hands over are changed on Salon → Business settings.
What each role sees #
With the permissions a new installation starts with. A permission you give a role on the roles page adds its pages.
| Menu | Owner | Manager / Front desk | Staff |
|---|---|---|---|
| Overview: Overview, Get started | ✓ | — | — |
| Front desk: Calendar, Find an appointment | ✓ | ✓ | once linked (own appointments) |
| Front desk: My day | once linked | once linked | once linked |
| Front desk: New booking, Call-backs, End of day | ✓ | ✓ | — |
| Front desk: Walk-in | ✓ | ✓ | ✓ |
| Front desk: Reminders, Online booking | ✓ | — | — |
| Salon: Hours, staff and services, Staff | ✓ | ✓ (read) | — |
| Salon: Business hours, Closures and holidays, Location, Home visits, Services, Staff sign-in, Business settings | ✓ | — | — |
| Salon: My schedule | once linked | once linked | once linked |
| Clients: Clients | ✓ | ✓ | — |
| Reports: Reports | ✓ | — | — |
| Payments: Orders, Reconciliation | ✓ | ✓ | — |
| Payments: Discounts, Taxes | ✓ | — | — |
| Shop: Shop orders, Stock, Returns | ✓ | ✓ | — |
| Shop: Products, Categories, Delivery, Shop reports | ✓ | — | — |
| Website: Homepage, Pages, Blog, FAQs, Menus, Legal pages, Business profile, Brand, Enquiries | ✓ | — | — |
| Appearance: Themes, Colours and mode, Typography, Layout and motion, Images | ✓ | — | — |
| Media: Media library | ✓ | — | — |
| People: People, Team, Deletion requests, Roles and permissions | ✓ | — | — |
| Messages: Messages | ✓ | ✓ | — |
| System: Audit log | ✓ | ✓ (read) | — |
| System: Website settings, E-mail (SMTP), SMS (text messages), Push notifications, Stripe, PayPal, Razorpay, Payment options, Google sign-in, About this software, Licences, Before you go live, Updates | ✓ | — | — |
| System: Software license (in the edition activated with a license key) | ✓ | — | — |
| Account menu: My profile | ✓ | ✓ | ✓ |
| Account menu: Two-step sign-in (once the site’s e-mail is set up) | ✓ | — | — |
“Once linked” means the account is linked to a staff member on Salon → Staff sign-in (below). Until then the menu leaves those pages out.
Scope inside a page. A staff member sees only appointments that include one of their own services. Anyone else’s appointment answers “not found” — on the pages and through the API, for reading and for changes alike. A staff member without See client phone numbers and e-mail addresses sees their own clients’ names and notes, not their phone numbers or e-mail addresses. Staff phone numbers and e-mail addresses are never shown to clients.
Refusals. A page the account may not open answers “forbidden”. Clients and accounts without a role are refused everywhere in the administration area.
Staff sign-in: link an account to a staff member #
My day and My schedule — and, for the Staff role, the Calendar and Find an appointment — show the appointments and hours of the staff member linked to the signed-in account.
- Open Salon → Staff sign-in (permission Manage staff members).
- For each staff member the table shows the account they sign in as. Choose an account under Choose an account and select Link, or select Unlink to remove the link.
The list offers active accounts with a staff, manager / front desk or owner role that are not linked to another staff member; an account appears once its holder has set their password. Clients never appear. One account belongs to at most one staff member. Unlinking keeps the staff record and its appointments. Every link and unlink is written to the audit log.
An owner who also works with clients can link their own owner account to their staff member, and then has My day.
