Reviewed October 17, 2026. This practical guide replaces an earlier general overview; the original publication date and URL are retained.
A new point-of-sale rollout needs an access plan as well as a checkout demonstration. A cashier, shift supervisor, bookkeeper and owner rarely need identical permissions. Testing these roles before launch can expose unnecessary refund authority, shared accounts and reporting access that would otherwise become normal practice.
Write roles around real tasks
List the work each role must complete: taking payment, finding an order, approving a refund, closing a shift or exporting a report. Give every sensitive action an approving role and a backup. Avoid defining a role as “everything the previous manager could do” when nobody has reviewed those permissions.
Test the denied action too
Log in with an authorized test account for each role. Verify both the permitted workflow and actions that should be blocked, such as changing settlement details or issuing an out-of-policy refund. Save the result and the system version. A visible menu item is not proof that the back-end permission is configured correctly.
Plan for temporary and departing staff
Record how access is requested, approved, assigned and removed. Seasonal hiring makes this especially useful for Florida businesses that change staffing levels. Time-limited access should have a named owner and review date. Do not let a temporary worker’s account become the permanent way another employee opens a shift.
Use the audit trail in a routine review
Ask the vendor how privileged changes are logged and how an authorized reviewer can obtain those logs. Review exceptions and remove permissions no longer needed. Keep a recovery path for a locked-out supervisor so operational pressure does not become a reason to share an owner’s password.
Source and next steps
PCI SSC’s merchant resources address people, processes and payment security. Use those resources alongside the POS vendor’s documented access controls. Read PCI SSC merchant security resources.
Continue with Choosing a POS System: Test the Full Workday Before Signing and Payment Cybersecurity: Protect Access, Device Changes and Recovery.
For the regional operating checklist and further reading, use the AMS Florida merchant guide. Explore related topics in Eric Kuvykin’s reading paths.
