Built for shift teams:
Designed for EU Working Time rules
ENPTES
|
ChegattaWorkforce OS
Home
Back to blog
Roles & Permissions

One Site, One Rule: Roles That Don't Leak

Tested: site-bound permissions — a manager for Site A can't approve Site B, and kiosk rights stay per site.

CT

By Chegatta Team

1 min read

Share

The Real-World Context

A manager for Lisbon should not approve Porto. A kiosk tablet should not see every site.

The Test Scenario

We gave a manager kiosk-read on Site Lisbon only via SiteManagerGrants, then tried to read Kiosk on Site Porto and to approve overtime on Porto.

How It Works (The Mechanics)

  1. Per-site grants — SiteManagerGrants kiosk-read/update bound to site_id.
  2. Policy check — KioskPolicy checks grants->hasPermission(user, site, kiosk-read).
  3. Business fallback — admins with business_id match still pass where allowed.

The Results / What We Verified

  • Lisbon read allowed, Porto denied. Pass.
  • Overtime approval blocked on Porto. Pass.

Honest caveat: Grant setup is manual per site — copy grants don’t auto-inherit when you add a new site.

Call to Action

Set permissions per site in seconds — Instant 2-Minute Setup • No Credit Card Required. Try Chegatta free at Chegatta.com.

CT

About Chegatta

Chegatta is a verified, compliant attendance platform for staffing agencies and businesses. Our team writes practical guides on attendance, payroll compliance and preventing time theft.

Related posts

We Tested Break Deductions and Overtime So You Don't Overpay

How Chegatta splits regular vs overtime, excludes unpaid breaks, and handles daily vs weekly thresholds — tested with real shift mess.

Read more

Compliance & Regulations: Chegatta's Multi-Country Payroll Compliance

How Chegatta ensures multi-country payroll compliance for business clients across US states and EU countries. Automatic overtime, break penalties, holiday pay, and audit-ready records save $1,300+/month.

Read more

Device Fingerprinting vs Privacy: What Chegatta Actually Checks

Exact device data checked to stop buddy punching — User-Agent, language, app version — and what we never check, plus 90-day anonymization.

Read more
Instant 2-Minute Setup • No Credit Card Required

Start Running Accurate Shift Roster & GPS Clock-In Today

Zero hardware cost. Automate time tracking, shift verification and banking-grade SEPA payroll exports.

14 days full accessZero setup hardwareCancel anytime