User and Role Management

User and Role Management

User and role management is a security-focused configuration module that determines who can access the hotel management system and what operations each user can perform. Properly defined roles and permissions are of great importance for both operational efficiency and data security.

Adding Users

When adding a user, first name, last name, email address, phone number, and username information are entered. A temporary password is created for the initial login, and the user is required to change their password on first login. One or more roles can be assigned to each user. User status is set as active or inactive, and inactive users are prevented from logging into the system. Rather than deleting departing staff accounts, they are set to inactive to preserve historical transaction records.

Core Roles

The system has five core roles defined:

• Admin role: Has unlimited access to all system modules. Can perform all operations including user management, settings, pricing, and reporting. It is recommended to keep the number of admins limited for security purposes.
• Receptionist role: Focuses on front office operations. Handles reservation creation, check-in, check-out, folio management, and guest profile operations. Does not have authority to make price or setting changes.
• Accountant role: Provides access to financial operations. Folio corrections, invoice generation, revenue-expense reports, and cash management fall within this role's authority. Does not perform room management or reservation operations.
• Housekeeping role: Provides access to room status updates and cleaning lists. Can change room status to dirty, clean, or inspected. Can create lost-and-found records but cannot access financial operations.
• POS role: Focuses on point-of-sale operations. Handles opening checks, adding items, and taking payments at restaurants, bars, spas, and other revenue centers. Can perform folio transfers but has limited authority for price changes or cancellations.

Module Access Permissions

Module access permissions are configured separately for each role. View, add, edit, and delete permissions can be independently enabled or disabled for each module. For example, a receptionist can be allowed to view and add reservations but not delete them. In special cases, additional permissions can be granted or restrictions applied on an individual user basis.

Session Management

Session management enables monitoring of active user sessions. The number of devices that can be logged in simultaneously can be limited. Automatic session termination activates after a period of inactivity. An administrator can remotely terminate any user's session in case of suspicious activity. All login and logout operations are recorded with date, time, and IP address information.