Skip to main content

Authorization

Control who can access what within your organization.

Overview​

Olympus Cloud uses a role-based access control (RBAC) system with:

  • Roles - Collections of permissions
  • Permissions - Specific actions on resources
  • Policies - Conditional access rules
  • Multi-tenancy - Isolation between organizations

Roles​

System Roles​

RoleDescription
Super AdminFull platform access
Organization OwnerFull organization access
Organization AdminManage organization settings and users
Location ManagerManage specific locations
Staff MemberStandard operational access
Read OnlyView-only access

Custom Roles​

Create roles tailored to your needs:

  1. Go to Settings > Roles
  2. Click Create Role
  3. Name and describe the role
  4. Select permissions
  5. Save

Permissions​

Permission Structure​

Permissions follow the pattern: resource:action

ResourceActions
orderscreate, read, update, delete, void, refund
menucreate, read, update, delete, publish
userscreate, read, update, delete, invite
reportsread, export
settingsread, update

Permission Categories​

CategoryPermissions
Order ManagementCreate orders, process payments, void
Menu ManagementEdit items, pricing, availability
Staff ManagementAdd users, assign roles, schedule
FinancialView reports, export data, refunds
ConfigurationUpdate settings, integrations

Assigning Roles​

To Users​

  1. Go to Users
  2. Select user
  3. Click Edit Roles
  4. Assign roles
  5. Save

Role Inheritance​

  • Users can have multiple roles
  • Permissions are additive
  • Most permissive access wins

Location-Based Access​

Scoped Access​

Limit users to specific locations:

  1. Assign role with location scope
  2. User only sees that location's data
  3. Actions restricted to scope

Multi-Location Users​

For users across locations:

  • Assign role per location
  • Or use organization-wide role
  • Configure default location

Policies​

Policy Types​

TypeDescription
Time-BasedAccess during specific hours
IP-BasedAccess from specific networks
Location-BasedAccess from geographic regions
Device-BasedAccess from trusted devices
Risk-BasedDynamic access based on risk score

Creating Policies​

  1. Go to Settings > Policies
  2. Click Create Policy
  3. Define conditions
  4. Set enforcement action
  5. Assign to roles or users

Policy Examples​

Office Hours Only:

Allow access when:
- Time is 6:00 AM - 10:00 PM local
- Day is Monday - Sunday

Corporate Network:

Allow access when:
- IP is in trusted range
- OR device is registered

Multi-Tenant Authorization​

Tenant Isolation​

  • Users belong to one organization
  • Cannot access other tenants' data
  • Strict boundary enforcement

Cross-Tenant Access​

danger

Cross-tenant data access bypasses normal isolation boundaries. All cross-tenant access requires explicit permission, is fully audited, and must use time-limited sessions. Unauthorized cross-tenant queries are treated as security incidents.

For platform administrators:

  • Explicit permission required
  • Audited access
  • Time-limited sessions

API Authorization​

Token Permissions​

API tokens include:

  • User's role permissions
  • Explicit token scope restrictions
  • Resource-level access

Checking Permissions​

Before operations:

  1. Token validated
  2. User permissions loaded
  3. Resource access checked
  4. Action allowed or denied

Audit Logging​

Logged Events​

EventDetails
Permission GrantedWho, what, when
Permission DeniedWho, what, why
Role ChangeUser, old/new roles
Policy ViolationUser, policy, action

Viewing Audit Logs​

  1. Go to Security > Audit Logs
  2. Filter by user, action, time
  3. Review entries
  4. Export if needed

Best Practices​

Role Design​

  • Keep roles focused
  • Use descriptive names
  • Document purpose
  • Review regularly

Permission Assignment​

Best Practice

Follow the principle of least privilege: assign only the permissions a user needs for their role. Use roles rather than granting individual permissions, and schedule quarterly access reviews to remove unused permissions.

  • Follow least privilege
  • Use roles, not individual permissions
  • Regular access reviews
  • Remove unused permissions

Policy Management​

  • Test before enforcing
  • Monitor impact
  • Communicate changes
  • Keep policies simple

Troubleshooting​

Common Issues​

IssueSolution
Can't access featureCheck role permissions
Action deniedCheck policy restrictions
Can't see locationVerify location scope
API returns 403Check token scope

Diagnosing Access Issues​

  1. Check user's roles
  2. Review role permissions
  3. Check applicable policies
  4. Review audit log for denials