Guide · Operations · 9 minutes

Staff permissions and roles, done properly.

Permission design is one of the operational areas where software gets more painful as an organisation grows. Guest Talk provides a permission model that begins with a handful of prebuilt roles and scales to fine-grained per-feature toggles. This guide covers the design principles, the prebuilt roles we ship, and the shift-handover RACI matrix we use inside our own customer success team.

Design principles

Least privilege. Every user is granted the minimum permissions required for their role. New users default to a read-only role until an administrator confirms the required permissions.

Task-oriented, not screen-oriented. Permissions map to tasks (create reservation, refund a folio, edit a rate) rather than to screens (access billing tab). This means UI changes do not silently expand or restrict permissions.

Separation of duties. Some tasks require two people. Refunds above a configurable threshold require approval from a second user with the appropriate role.

Auditable by default. Every action is logged with user, timestamp and outcome. The audit log is exportable and immutable.

Prebuilt roles

• Owner. Full access to everything including billing, user management and workspace deletion. Typically one or two users; two-factor authentication mandatory.
• General Manager. Same as Owner except cannot delete the workspace or change billing details. Can manage users up to General Manager level.
• Revenue Manager. Full access to rates, strategies, promotions and reporting. Cannot manage users or billing. Cannot refund folios.
• Front-Office Manager. Full access to reservations, guests and folios. Can refund up to the configurable threshold. Cannot change rates or user permissions.
• Front-Office Agent. Can create and modify reservations, check guests in and out, split and settle folios. Cannot refund; can request a refund from a Front-Office Manager.
• Housekeeping Manager. Full access to the housekeeping board and inspection tools. Can override room-status assignments. Read-only on reservations.
• Housekeeper. Read the day's assignment on the mobile app. Update room status (clean, dirty, out of service). No access to reservations, rates or guest financial details.
• Accountant. Read access to folios, invoices, payments and reports. Can create adjusting journals and post to the accounting export. No access to modify reservations.
• Marketing. Access to guest lists (with marketing consent), messaging templates and analytics. No access to financials or user management.
• Read-only. Default for new users; sees the calendar and dashboards but cannot mutate anything.

Custom roles

Where the prebuilt roles do not fit, custom roles combine any subset of the individual permissions. Common custom roles we see: a "Night Auditor" role that combines Front-Office Agent with the ability to post daily close-out; a "Group Sales Coordinator" role that adds the group-sales module to a Front-Office Manager; a "Concierge" role that adds messaging-template creation without any financial permissions.

Multi-property permissions

Users in a group have a role per property plus an optional group-level role. A typical configuration: a group Revenue Manager has the Revenue Manager role at group level and inherits it at every property; a property General Manager has the General Manager role at their property and Read-only at the others. The permission engine composes these grants; the effective permission at any moment is the union of the group and property grants.

Shift-handover RACI

Handover between shifts is where most operational mistakes are introduced. Guest Talk provides a shift-handover checklist inside the workspace; the RACI matrix below is a starting point that most properties customise.

Onboarding a new staff member

1. General Manager creates the user in the workspace with the appropriate prebuilt role.
2. Guest Talk sends an invite email; the new user sets their password and enables two-factor authentication (mandatory).
3. The new user completes the interactive tour built into the workspace for their role.
4. General Manager reviews the audit log for the new user after the first shift; adjusts permissions where actual work required more (or less) than the prebuilt role.

Offboarding

1. General Manager deactivates the user; the user immediately loses access to the workspace.
2. Guest Talk reassigns any open tasks (reservations in progress, tickets, drafts) to a nominated user.
3. User is deleted permanently after 30 days if no further action is taken; audit log entries remain associated with the (former) user identifier for compliance.

Audit and compliance

The audit log records every action by every user, including the previous and new value where a field is modified. The log is retained for 12 months (24 months for financial actions) and is exportable in CSV or JSON. Two mandatory audit reports run automatically: a weekly login summary and a monthly permission-change summary. Both are delivered by email to the General Manager.

Two-factor authentication

Two-factor authentication is mandatory for Owner, General Manager, Accountant and Marketing roles by default. All other roles default to optional-but-recommended; the General Manager can enforce two-factor for the whole property with a single toggle. Supported second factors: TOTP (Google Authenticator, Authy, 1Password), FIDO2 security keys, and SMS as a legacy fallback (discouraged in 2026 due to SIM-swap risk).

Common pitfalls

Owner role sprawl. "Just give me Owner for now" is how five out of ten Owner-level accounts get created. Push back: use General Manager for anyone who is not the legal owner or the CTO.

Shared logins. Never. Shared logins destroy the audit trail and make offboarding a security incident. Every human has their own account.

Role creep. Roles get widened over time as new features arrive. Review roles quarterly; the workspace surfaces roles that have been used less than five times in the past quarter as candidates for retirement.

Checklist

• Owner role reserved for two humans maximum.
• Every user has a role appropriate to their tasks.
• Two-factor enforced for Owner, GM, Accountant and Marketing.
• Shift-handover checklist enabled in workspace settings.
• Weekly login summary emailed to GM.
• Offboarding runbook documented and known to reception managers.