←
Access
Which role sees what. Read-only — this mirrors shop_os/shared/authz.py
(CAPS). Visibility shaping, not security (docs/completed/UI-UNIFICATION.md).
| Capability | Owner | VA | Lead | Staff | Contractor |
|---|---|---|---|---|---|
| Pay & rates pay | ✓ | · | · | · | · |
| Reports reports | ✓ | · | · | · | · |
| Setup setup | ✓ | · | · | · | · |
| Receiving (count stock in) receiving | ✓ | ✓ | ✓ | ✓ | · |
| PO import / Finale receiving po_import | ✓ | ✓ | · | · | · |
| Finale export queue finale | ✓ | ✓ | ✓ | · | · |
| Work stations stations | ✓ | · | ✓ | ✓ | · |
| Products & inventory value products | ✓ | · | · | · | · |
Legacy role aliases
The live roster still uses old role names; these resolve to a governed role above until the stored values are migrated.
- cleaner → Contractor
- tech → Staff
- warehouse → Lead