User roles and permissions

Simply put

The cashier sells but cannot delete an invoice, the storekeeper receives goods but cannot change prices, and the accountant posts entries but cannot change salaries. This is segregation of duties, one of the most important internal control tools.

Define a role with its permissions for each job, give the user the role rather than permissions one by one, and review them when an employee moves or leaves.

Example

In a chain of stores, the "Cashier" role allows sales and returns only up to a set amount, the "Branch supervisor" role approves larger returns and discounts, and neither of them sees the profits of other branches.

Don't confuse it with