Deciding who on your team can do what

Why permissions exist here at all

It is tempting to treat staff access as bureaucracy for a business with four people in it. It is not, and the reason is specific to loyalty.

A stamp is a small piece of value. A card that reaches its target produces something real that leaves the shop without being paid for. That is fine — it is the whole point — but it only works because the count is trustworthy, and the count is only trustworthy because a limited, identified set of people can change it.

Remove that and the program still runs. It just stops being a record and becomes an honor system with a screen attached.

What a new starter needs on day one

Almost nothing. One capability:

Issue stamps.

That is the whole job at the counter. They validate a visit that happened in front of them. They do not need to see the customer list, read the analytics, edit the program, or send anything.

This is not distrust. It is that every additional control is a thing they can do by accident on their third shift while somebody waits to be served, and none of the extra ones help them do the job.

Add view customers if your program involves looking anyone up — for instance if customers regularly arrive without their card. Otherwise leave it off.

The three worth withholding

Some controls are genuinely different in kind, because their effects are not visible in the moment.

Editing the program. Changing the stamp target or the reward alters the deal for every customer holding a card, including ones halfway through. This is an owner decision, not an operational one, and it should not sit next to the stamp button.

Adjusting a card by hand. There has to be a way to fix a mistake — a stamp missed during a rush, a double-stamp, a customer whose card was reset. But manual adjustment is the one control that can add value without a corresponding visit, which makes it the one worth bounding. Give it to the people who cover the counter unsupervised, and cap how much they can change at once and how often in a day.

Sending to customers. A campaign reaches everyone at once and cannot be recalled. The number of people who should be able to do that is small, and it is usually not the same set as the people who work the till.

Roles are a starting point, not the decision

A three-role structure — owner, manager, staff — describes authority, not tasks. Two people with the same title frequently need different things: the weekend supervisor who opens and closes needs manual adjustment; the weekday assistant who works alongside you does not.

So treat the role as a preset and then set the specific permissions. The role answers “who can act on whom”; the permissions answer “what can they touch”.

One rule worth keeping regardless of structure: authority runs one way. A manager should not be able to remove an owner or promote another manager. That is what stops a single compromised or disgruntled account from becoming an unrecoverable one.

Reviewing access, and the part everyone skips

Access decays quietly. Someone covers a shift, gets a permission for a week, and keeps it for two years. Someone leaves and their account stays live because removing it was nobody’s specific job.

Two habits fix nearly all of it:

• Remove access the day someone leaves, in the same motion as the rest of the leaving process.
• Read the list once a quarter and ask, for each person, whether they still do the thing that permission was for.

Neither takes long. The reason to write them down is that both are invisible when neglected — an over-permissioned team looks exactly like a correctly permissioned one until something goes wrong.

Doing this in NeoLoyal

Team and roles covers this directly. Three roles — owner, manager, staff — and eleven separate permissions covering stamping, customers, the program, campaigns, analytics, team management and locations. You tick what the job needs rather than accepting a bundle.

Invites are links that expire and can be revoked, and can be locked to a single email address so the link is useless to anyone else. Ownership is never handed out through an invite: it is reached by transferring it to someone already inside, which means a leaked link cannot produce an owner.

Permissions are copied onto the person when they accept, so changing a role’s preset later never silently rewrites what an existing member can do.

Someone allowed to adjust cards by hand can be capped on how much they may change at once and how often in a day — the bound described above, without needing a policy nobody reads.

Staff accounts are unlimited on every plan, including free. Charging for the people who run the program would price a business out of the safeguard that makes the count worth having.

The summary

Give new staff the stamp button. Add capabilities when the job actually requires them. Keep program edits, manual adjustments and sending in a smaller set of hands, and remove access the day someone leaves.

The point is not control. It is that a loyalty count only means something because of who cannot change it.