Roles and permissions
What OWNER, HEAD_MANAGER, MANAGER, and STAFF can each do in Klu.
Overview
Klu has four roles arranged in a hierarchy. Each role determines which sidebar pages you see, which actions you can take, and which teammates you can manage.
When to use it
- Deciding what role to assign a new teammate
- Figuring out why a button is greyed out for a user
- Understanding who can revert sales, delete products, or approve purchase orders
How to use it
- Open Settings -> Team (OWNER and HEAD_MANAGER only).
- Pick the role that matches the person's actual job — err on the side of less access.
- Send the invite, or change an existing member's role from the row menu.
Role hierarchy
- OWNER — full access. Can do anything including billing, deletion, and team management. Created at signup; can be transferred but there is always exactly one per organization.
- HEAD_MANAGER — can manage MANAGER-level users and below; can approve purchase orders, manage inventory, create promotions. Cannot touch subscription or delete organization-wide data.
- MANAGER — day-to-day branch operations: inventory moves, staff PIN management, shift oversight, promotions. Cannot invite or change team members.
- STAFF — front-line: view most pages, move stock, record waste, ring up sales on the iPad. Cannot create or edit products, and cannot delete data.
Common role gates
- Invite team members: OWNER, HEAD_MANAGER (HEAD_MANAGER can only invite at MANAGER level or below).
- Delete products: OWNER only.
- Approve purchase orders: OWNER, HEAD_MANAGER, MANAGER.
- Upgrade subscription / change billing: OWNER only.
- Manage branches: OWNER only.
- Move stock / record waste: all roles, including STAFF.
Tips & gotchas
- HEAD_MANAGER can only manage MANAGER and below — never another HEAD_MANAGER or OWNER.
- Changing someone from OWNER to a lower role immediately removes their billing and deletion access.
- STAFF users on a multi-branch org are typically scoped to a single branch — they only see data from that branch.