In Square, employee permissions are managed with permission sets: named bundles of access that you assign to team members. For a coffee shop, a good setup usually means three levels: baristas who can ring up sales, shift leads who can handle refunds and the cash drawer, and owners or managers with full access. Pair those sets with personal passcodes so every action is tied to a person.
This guide covers how permission sets work, a role-by-role plan for a typical shop, and the security habits that prevent most problems.
How Square permission sets work
You create and edit permission sets in Square Dashboard under Staff, Team, Permissions, then Create permission set. Square's help center notes that creating and editing new sets happens in Dashboard, and you need at least one team member added before you can create custom sets.
- Starting levels. New sets start from one of three levels: Standard (basic permissions to take transactions, suited to cashier roles), Enhanced (suited to shift leads and managers) or Full (suited to co-owners and general managers). You then adjust individual permissions.
- Full access is nearly everything. Square describes Full access as including all permissions except managing bank accounts, including sales reports and team member permissions. Assign it sparingly.
- Access points. Permissions control what people can see and do across Square Point of Sale, the Square Team app, Square Dashboard and the Square Dashboard app. When you customize a set, you choose which of these its members can use.
- Plan limits. How many custom sets you can create depends on your Square subscription. Square's help center lists one custom set on Square Shifts Free and Square for Restaurants Free, two on Shifts Plus and Retail Plus, and unlimited on several higher plans including Square Plus and Premium. Check your plan before designing many roles.
Personal passcodes versus the team passcode
Every Square account starts with a team permission set tied to a team passcode that everyone on that set shares on a shared point of sale. It is convenient, but Square notes it cannot track sales, time or activity by individual team member. Personal passcodes do. For a coffee shop with a busy shared register, personal passcodes are worth the extra second at sign-in, because they tell you who issued a refund or opened the drawer.
A permission plan for a typical coffee shop
Here is a starting point for a single-location cafe with eight team members. Adjust names and details to your shop, and check the exact permission toggles available in your Dashboard.
| Role | Start from | Typically allow | Typically restrict |
|---|---|---|---|
| Barista | Standard | Take payments, apply preset discounts, clock in and out, view own schedule | Refunds, editing items and prices, reports, customer exports |
| Shift lead | Enhanced | Refunds within policy, cash drawer management, voids, 86ing items, approving breaks | Team management, bank and payout settings, full reports |
| Manager | Enhanced, customized | Scheduling, editing the menu, inventory, sales reports | Bank accounts, account settings, permission changes |
| Owner or co-owner | Full | Everything they need to run the business | Keep the number of Full access users small |
Set it up, step by step
- List your roles and their real tasks. Write down what each role does on a normal shift and on a bad one (a customer wants a refund, the register is short).
- Create one set per role. Start from the closest level, then turn off anything the role does not need.
- Choose access points. Most baristas only need the point of sale and the Square Team app. Few people need Dashboard.
- Assign sets and locations. When you add or edit a team member, assign their permission set and the locations they work at. Locations determine which menus, items and reports they can access.
- Test it. Sign in as a test barista and try a refund, a discount and a report. Confirm the restrictions behave the way you expect.
Security habits that matter more than settings
- No shared passcodes for sensitive actions. If the person issuing refunds is anonymous, so is any problem.
- Review refunds, voids and discounts weekly. Look for patterns by team member and time of day, and ask questions early and calmly.
- Deactivate on the last day. When someone leaves, deactivate them in Square the same day. Deactivation keeps their history, and you can reactivate them later.
- Protect customer data. Limit who can view and export the customer directory and marketing lists.
- Audit once a quarter. Re-check who has Full access and whether each set still matches the job.
Common mistakes
- Giving everyone Full access "to save time", which also hands them reports and team permissions.
- Promoting a barista to shift lead without updating their permission set.
- Letting a manager change their own permissions instead of having the owner do it.
Fewer people on the register, fewer permissions to manage
Every person who takes payments needs access to the point of sale. Self-ordering reduces how much of that work happens behind the counter. With Orda Express self-ordering kiosks, customers order and pay on a tablet with a Square reader, and orders flow straight into Square POS. Your branded coffee shop app does the same for order-ahead. More than 10,000 Square businesses have used Orda.
Related guides: managing multiple users in your Square account, Square team tools for coffee shops and tracking hours with Square timecards.