Illustrative previewA build-to-order Magento 2 / Adobe Commerce extension that adds granular cashier roles, permission controls over discounts, voids and refunds, manager-PIN overrides, clock-in/out shift tracking and per-cashier sales reporting — engineered, installed and supported by ECOSIRE.
Key Features
Role-based POS permission registry wired through Magento admin ACL (acl.xml) — assign discount, void, refund, price-override and reprint rights per role, enforced server-side via di.xml plugins so the browser cannot bypass a denied action
Manager-approval PIN flow: when a cashier lacks a permission, the POS prompts for a manager PIN validated by a service contract; the override is recorded against the operator, the approver and the order
Configurable discount thresholds — cashiers can discount up to a percentage/amount limit; anything beyond requires manager authorization, evaluated in a quote/cart plugin before totals are recalculated
Void and refund gating via observers on order and credit-memo events, blocking unauthorized voids and refunds and writing every attempt to an immutable audit log
Staff clock-in / clock-out shift tracking with shift records, break handling and a cron job that flags or auto-closes orphaned open shifts
Per-cashier sales reports in admin: revenue, transaction count, average basket, void/refund counts and override frequency, filterable by date range and outlet
Commission calculation per cashier based on configurable rules (flat, percentage, or tiered) with exportable statements
Outlet / store-view scoped access so a cashier assigned to one location cannot operate or report on another
REST and GraphQL endpoints exposing shifts, permission checks, override events and per-staff reports for headless POS front-ends and external BI tools
Full audit trail of every override, void, refund and shift event with operator, approver, timestamp and reason code
Adobe Commerce-aware: respects multi-website / multi-store-view scope and integrates with shared-catalog and B2B structures where present
Upgrade-safe module packaging (composer-installable, follows Magento coding standards) so it survives core patches and `setup:upgrade`
Built to order, done for you
No DIY setup — a working app, built, installed and supported by ECOSIRE.
- 1
You order
Start with a one-time build price. We scope it with you at kickoff.
- 2
We build & install
ECOSIRE builds, configures and installs it on your Magento 2.
- 3
Go live + support
You go live in about 2–4 weeks, with a post-launch support window.
About this Product
Most Magento 2 POS deployments treat every till operator the same: anyone signed in can apply a 50% discount, void a line, or process a refund without a trace. For multi-staff retail and restaurant operators, that is a direct path to margin leakage and shrinkage. This extension closes the gap with a proper accountability layer purpose-built for the point of sale.
ECOSIRE engineers this as a dedicated module under app/code/Ecosire/PosStaffControl, integrating with your Magento Open Source or Adobe Commerce POS (Magento POS, MageWorx, Webkul, or a custom React/PWA till) via service contracts and REST/GraphQL endpoints rather than brittle template hacks. Cashier roles are defined against a new permission registry wired through acl.xml and enforced server-side with plugins/interceptors declared in di.xml, so a blocked void cannot be bypassed from the browser.
Each sensitive action — discount beyond a threshold, line/order void, refund/return — is gated. When a cashier lacks the permission, the POS prompts for a manager-approval PIN; the override is validated by a service contract and written to an audit log via an observer on the order/credit-memo events. Staff clock-in/clock-out is captured against shift records, and a cron job reconciles open shifts. Per-cashier sales, override frequency and commission are surfaced in admin reports and exposed over the API for your BI tool.
Because it is built to order, ECOSIRE scopes it to your exact POS, your outlet/store-view structure and your reporting needs, then installs and supports it. No generic one-size extension, no guessing — a clean, upgrade-safe module that survives Magento patches.
What you get
- A custom Magento 2 module (Ecosire_PosStaffControl) delivered as a composer-installable package, compatible with your Magento Open Source or Adobe Commerce version and PHP runtime
- Integration with your specific POS (Magento POS / MageWorx / Webkul / custom PWA) via service contracts and REST/GraphQL, scoped during discovery
- Admin configuration: role/permission registry, discount thresholds, commission rules and outlet scoping, plus per-cashier reporting screens
- Database schema (declarative schema db_schema.xml) for shifts, override events and audit logs, with data patches for initial roles
- Installation on your staging and production environments, including setup:upgrade, di:compile and static-content deploy verification
- Documentation: admin user guide, permission matrix, API reference for the exposed endpoints, and a short operator runbook for cashiers and managers
Who this is for
Multi-Outlet Retail Operations Manager
Runs several stores on one Magento 2 backend and needs every discount, void and refund tied to a named operator, with per-cashier sales and override reports to spot leakage early.
Restaurant / QSR Owner
Wants servers and cashiers clocked in on shifts, comp and void authority restricted to managers via PIN, and end-of-shift reconciliation against till totals to deter theft.
Adobe Commerce IT Lead
Needs an upgrade-safe, ACL-aware module that enforces permissions server-side and exposes shift and override data over the API for the company BI stack, without forking the POS.
How Magento 2 POS Staff Roles, Permissions & Shifts Compares
| Criterion | ECOSIRE | Custom Build | Competitor | Odoo Native |
|---|---|---|---|---|
| Server-side permission enforcement for discount / void / refund (not bypassable in browser) | Included | Partial support | Partial support | |
| Manager-approval PIN override flow with recorded approver | Included | Partial support | Partial support | |
| Staff clock-in / clock-out shift tracking with cron reconciliation | Included | Partial support | Partial support | |
| Per-cashier sales, override and commission reporting | Included | Partial support | Partial support | |
| Scoped to your exact POS, outlets and reporting needs | Included | Included | Not included | |
| Installed, deployed and supported for you | Included | Partial support | Not included | |
| Upgrade-safe (ACL, di.xml plugins, declarative schema — no core hacks) | Included | Partial support | Partial support | |
| REST / GraphQL API for headless POS and BI tools | Included | Partial support | Partial support |
Frequently Asked Questions about Magento 2 POS Staff Roles, Permissions & Shifts
Is this an instant download from the Adobe Commerce Marketplace?
No. This is a build-to-order extension. After purchase ECOSIRE runs a short discovery to confirm your Magento version, POS front-end and outlet structure, then engineers, installs and configures the module on your environments. It is not a one-click Marketplace download.
What is the typical delivery lead time?
Most builds are delivered in roughly 2 to 4 weeks from the discovery call, depending on which POS you run and the depth of your permission, commission and reporting requirements. We confirm a firm timeline in writing before work starts, and deploy to staging for sign-off before production.
Do you provide ongoing support and updates?
Yes. The build includes a support window for bug fixes and adjustments after go-live, and we offer ongoing maintenance to keep the module compatible across Magento / Adobe Commerce patch releases and your POS upgrades. Because the code is yours, you are never locked to a subscription to keep it running.
Will it survive Magento core upgrades?
Yes. It ships as a properly namespaced, composer-installable module using di.xml plugins, observers, declarative schema and ACL — not core overrides or template edits — so it survives setup:upgrade and patch releases. We verify it against your target version during the build.
Can it enforce permissions for a headless or custom PWA POS?
Yes. All permission checks, PIN overrides and shift events are enforced server-side and exposed over REST and GraphQL, so a headless or custom React/PWA till consumes the same authoritative endpoints. The browser cannot grant itself a denied action.
Related Modules
Built to order
Magento 2
One-time
2Checkout / Verifone Gateway for Magento 2
A build-to-order 2Checkout / Verifone payment gateway for Magento 2 and Adobe Commerce: localized checkout in 12 languages, iDEAL, Giropay and regional methods, multi-currency global selling, subscription billing and tax/invoicing automation — engineered, installed and supported by ECOSIRE.
From $199.00Starting point — quoted to your scope
Built to order
Magento 2
One-time
3D Secure 2 / SCA Enforcer for Magento 2
A build-to-order Magento 2 extension that forces PSD2-compliant 3D Secure 2 authentication at checkout, with smart frictionless-versus-challenge routing, per-payment-method SCA enforcement, exemption handling (low-value/TRA) and liability-shift tracking. Gateway-agnostic, built and installed by ECOSIRE.
From $199.00Starting point — quoted to your scope
Built to order
Magento 2
One-time
Abandoned Cart Email Recovery
A custom-built Magento 2 / Adobe Commerce extension that automatically recovers lost carts with scheduled multi-step reminder emails, auto-generated coupons, one-click restore links and recovery analytics — engineered, installed and supported by ECOSIRE on your own store.
From $99.00Starting point — quoted to your scope
Built to order
Magento 2
One-time
Abandoned Cart Recovery & Automation
A custom-built Magento 2 / Adobe Commerce extension that detects abandoned carts and recovers revenue through scheduled, personalized email and SMS sequences. Built, installed, and supported on your store by ECOSIRE.
From $249.00Starting point — quoted to your scope
Request a quote
Magento 2 POS Staff Roles, Permissions & Shifts
A build-to-order Magento 2 / Adobe Commerce extension that adds granular cashier roles, permission controls over discounts, voids and refunds, manager-PIN overrides, clock-in/out shift tracking and per-cashier sales reporting — engineered, installed and supported by ECOSIRE.
- Role-based POS permission registry wired through Magento admin ACL (acl.xml) — assign discount, void, refund, price-override and reprint rights per role, enforced server-side via di.xml plugins so the browser cannot bypass a denied action
- Manager-approval PIN flow: when a cashier lacks a permission, the POS prompts for a manager PIN validated by a service contract; the override is recorded against the operator, the approver and the order
- Configurable discount thresholds — cashiers can discount up to a percentage/amount limit; anything beyond requires manager authorization, evaluated in a quote/cart plugin before totals are recalculated
- Void and refund gating via observers on order and credit-memo events, blocking unauthorized voids and refunds and writing every attempt to an immutable audit log