The menu password on a Post-it in the office is how a Saturday supervisor "just updates the specials" and how, three weeks later, nobody can say who removed the dairy flag. Shared logins feel practical. They delete the audit trail you will want after a complaint or an EHO visit.
Team roles give each person an account. Unlimited team members on every plan. No per-seat charge for putting the pass on the system.
Roles that match the building
Four levels cover most venues:
- Owners manage billing
- Admins manage the team
- Managers keep menus current
- Members can view
Everyone signs in as themselves. The role applies across the workspace, so a manager is not quietly an owner on one site and a guest on another. Invitations go out by email. Staff join with a secure link. You are not texting the same password to each new starter.
That split is also how you stop a keen host rewriting a recipe "to make it clearer" in the middle of service. Viewing the live menu is not the same job as publishing an allergen change.
Why the name on the edit matters
When something needs checking after a busy service, the activity trail shows who changed what. "Someone on the shared login" is not an answer you can take to a guest, an insurer or an environmental health officer. Preparing for an EHO visit is easier when the record and the menu point at the same recipes, and you can see who last touched them.
Front of house still need to answer questions. They do not all need publish rights. Point them at the live menu on a phone, and train against that screen. Allergen training for front of house works better when the tool in the drill is the tool on the shift.
Groups and busy sites
A group will want head office to own the base recipes and the site manager to own local availability. That is multi-location control plus roles: central people edit the shared record, local people are not locked out of marking a dish off. The principle is the same as one recipe record. Access rules stop that record forking into private copies.
What not to do with access
Do not give every starter admin because the invitation screen was confusing on day one. Do not leave ex-employees on owner accounts because "they might come back for a shift". Remove access when the person leaves. The menu is operational data and allergen data. Treat the login like the keys to the dry store.
A practical next step
List who truly changes prices and allergens, invite them as managers, and put everyone else on a view account if they only need to read the menu. Take the shared password off the pass this week.
See team roles, or how multi-location menus keep several sites on one workspace.