The Branch Manager Who Can Add a Cashier
A distributor with five branches either makes every branch manager an administrator or routes every new cashier through head office. Both are wrong. A delegated admin manages the people of their own branch, hands out only access they hold themselves, and cannot touch an administrator, their own account or anyone outside their patch.
A new cashier starts at the Kisumu branch on Monday. The branch manager knows her name, her shift and which till she will use. The only person who can create her account sits in Nairobi, is in a board meeting until four, and has two hundred other things to do. So by Monday afternoon the cashier is selling on the manager’s login, and every sale she rings up is recorded against somebody else.
The short version
Do not solve that by making the branch manager an administrator. Make them a delegated admin: they add and change the people of their own branches, they can only hand out access they already hold, and the permissions that make more administrators stay with the full Admin. Give it a reason and, where it is temporary, an end date.
The two usual answers both fail. Routing every account through head office is slow enough that people share logins, which destroys the audit trail the whole system exists to keep. Promoting the branch manager to Admin is fast, and it hands one person every permission in the workspace, including payroll, the bank accounts and the power to make more Admins. The second answer also tends to outlive the reason for it. We wrote about why the most powerful role is the one to keep smallest; this is the tool that lets you. The cashier a branch admin creates still lands on a till with a name on it, so the handover at each counter keeps one person accountable for the drawer.
Five kinds of delegate
| Type | Who they manage | What they can grant |
|---|---|---|
| Branch or warehouse admin | People placed at the warehouses you choose, at least one | Inventory, assets, procurement, vendors, sales and reports |
| Department admin | People in the departments you choose, at least one | HR self-service, projects, helpdesk and reports |
| Finance admin | Anyone inside the rules below | Accounting, billing, payables, receivables and tax |
| Security admin | Anyone inside the rules below | Security, device trust, compliance and audit-log access |
| Implementation partner | Anyone inside the rules below | Inventory set-up, custom fields, automation, integrations and notification settings |
The rules a delegate cannot talk their way past
Checked on every save, on the web and over the API
- Only permissions their type covers, and only those they hold themselves. A delegate cannot mint access they lack.
- Never the permissions that make more administrators: managing users and roles, access reviews, temporary access, delegations, security settings, the organization export or billing.
- Never an Admin, and never their own account.
- Never someone placed outside their warehouses or departments.
- Never someone who already holds more than the delegate could grant. Only a full Admin changes that person.
- A role only when every person holding it is someone they could manage, and never a role they hold themselves.
The checks run where the change is saved, not in the form, so the same refusal applies to the web screens, the API and bulk user actions. A refusal is a sentence rather than an error code: “Wanjiru holds access you cannot grant (approve payments), so only an Admin can change their account.” The user list a delegate sees is narrowed to their branches or departments, and someone outside the boundary who still appears gets the refusal when it matters, so nobody has to guess why a button did nothing.
Delegation is not a smaller Admin role. It is a boundary drawn around one person, in writing, with a date on it.
Writing the delegation down
Making someone a delegate needs a reason, and the reason goes on the audit trail beside who granted it. An end date is optional, and worth setting whenever the reason is temporary: an implementation partner setting up the first month, an acting branch manager covering leave. Each person has one live delegation at a time, so a new one replaces the old rather than stacking. Ending one early is a single action, also recorded. The live count appears in the settings snapshot of your compliance evidence pack, so an assessor sees how many people hold delegated rights without having to ask.
If your branches hire their own staff
A branch admin per branch
They create cashiers and storekeepers at their own warehouse, and the till and stock permissions they hold are the ceiling.
If a partner is setting you up
An implementation partner with an end date
They configure fields, automation and integrations, and the delegation ends on the day the project does.
If finance runs its own team
A finance admin
The finance lead grants accounting access to their people without being able to touch security or create an Admin.
Delegation shaped to your organization chart
The boundary, the checks and the audit trail are in place for five types. Three extensions come up most often.
Delegate types you define
Your own permission groups and placement rules, such as a regional admin across three named branches.
A second approver for a delegation
Granting delegated rights held until another Admin agrees, through the change review inbox.
A weekly digest of delegate changes
Every account a delegate created or changed, sent to the full Admins.
Three questions about your own administrators
How many people in your organization hold the Admin role?
What you will probably hear
Most of the managers.
How to read it
Each of them can make more Admins. Keep it to two or three and delegate the rest.
When a branch hires, how long until the new person has a login?
What you will probably hear
A day or two, through head office.
How to read it
In that gap people share logins, and the audit trail records the wrong name.
When did the implementation partner’s access end?
What you will probably hear
We would have to check.
How to read it
A delegation with an end date answers that before anybody asks.
What AWRA OpsHub does today
- Five delegate types: branch or warehouse, department, finance, security and implementation partner.
- A grant ceiling of the type’s permissions and only those the delegate holds, with the permissions that make administrators never grantable.
- People boundaries: never an Admin, never themselves, never outside their warehouses or departments, never someone holding more than they could grant.
- Role edits only when every holder is manageable, and never the Admin role.
- The same checks on the web, the API and bulk user actions.
- A required reason, an optional end date and one live delegation per person, each grant and revocation on the audit trail.
More we can add to your workspace
- Delegate types you define, with your own permission groups and placement rules.
- A second approver before delegated rights take effect.
- A digest of every change a delegate made, sent to the full Admins.
Where we point you to a specialist
- We will not let a delegate grant the permissions that create administrators. That stays with the full Admin, whatever the type.
A delegate type of your own is usually a day or two of work, because the boundary checks already read the type from one place.
See the admin command center
Delegated admins, stale access, the role impact preview, bulk user actions and industry setup templates, with one list of what is still to set up.
Explore the command centerFrequently asked questions
What is a delegated admin?
A person who is not a full Admin but can manage some users and roles inside a boundary: the people of their warehouses or departments, and only permissions their type covers that they hold themselves.
Can a delegated admin make someone an Admin?
No. The Admin role, and the permissions to manage users, roles, security settings, delegations, billing and the organization export, can never be granted by a delegate.
Can a delegated admin change their own access?
No. A delegate cannot change their own account, an Admin, or a role they hold themselves.
Does a delegation expire?
It can. An end date is optional when you create it, and an Admin can end it early at any time. Each person has one live delegation, so a new one replaces the old.
Do the limits apply to the API as well as the web?
Yes. The same checks run on the user and role screens, their API endpoints and bulk user actions.
