retail-admin
4 humans · Priya Shah, J. Osei, K. Ford, L. Nguyen · last changed 12 Jun 2026 (PII bulk-export removed after APP audit) · every save here queues for a second super-admin
Grants & scopes
Catalogue
View catalogue & inventory
all warehouses, incl. PO pipeline
Publish products & price rules
clearance price rules still need legal draft sign-off
See margin columns
deny override — margin lives with finance only
Orders & money
Fulfil, hold, exception-resolve
full orders & service group
Approve refunds
scope: ≤ $500 single-click · above routes to finance 4-eyes
Issue goodwill credits
scope: ≤ $20 per case
Customers & PII
View PII masked
email/phone partial by default on lists
Unmask on a record
forces a reason string into the audit log (APP 6)
Export PII columns
removed 12 Jun 2026 — APP audit finding #3; finance + counsel retain
Marketing & CMS
Approve coupons & campaigns
incl. SMS spend ≤ $5k
Publish home & content pages
scheduled swaps still name an on-call human
Edit legal pages
counsel-only, always
Platform
Users, roles, keys, flags, billing
super-admin only — this page
Read audit log
own actions visible in change logs; full log is super-admin + counsel
What Priya cannot do (by design)
Mint or edit roles — even her own
Refund > $500 alone (finance is the second pair of eyes)
Change GST rules or invoice sequence
Read the audit log wholesale (she sees her own change history)
Export customer PII in bulk
Role change history
Removed: exports · PII columns12 Jun · Dan + external auditor
Added: campaign approve ≤ $5k SMS2 May · Dan + Priya's sponsor mail
Scoped: refunds cap $1,000 → $50014 Mar · finance request
Role created (split from admin-all)20 Jan · Dan + counsel
Every role edit stores before/after JSON and both approvers' hardware-key signatures. "Test as this role" opens a read-only sandbox session — no writes, watermarked.