Custom Staff Roles and Sign-In Codes

Frontdesko lets you give each staff member a custom permission set, copied from a colleague in one click, and requires an emailed six-digit sign-in code from administrators, managers and finance managers. Together they limit what staff can do and who can get in.

By the Frontdesko team • Last updated 31 October 2026

Try the Live Demo

What does a Monday of custom roles and sign-in codes look like?

An illustrative scenario at a 30-room hotel. The hotel, staff and times are invented to show the screens as they work; they are not a customer account.

Time	What happens	Where in Frontdesko
08:30	The owner of a 30-room hotel in Cebu hires a weekend cashier who should take payments but never edit a booking. In Staff Management she adds the person and picks the base role Front desk agent. The Access permissions grid fills in with that role’s defaults and shows “Role defaults”.	Hotel admin → Staff Management → Access permissions
08:34	She unticks Add, Edit and Delete on Reservations, leaving View, and keeps full access to Billing & Payments. The badge flips to Custom role. She saves.	Access matrix: Reservations, Billing & Payments
08:40	A second cashier starts next week. Instead of repeating the clicks, she opens the new account and chooses Copy permissions from… and the first cashier’s name. The grid copies across. She saves, and both rows show a purple Custom tag.	Staff list, Copy permissions from…
09:05	The general manager signs in. After the password the screen asks for a six-digit Sign-in code, which has just arrived at the email address on his account. He enters it and is in.	Login screen, Sign-in code step
09:07	A front desk agent signs in a minute later. She is asked for the password only.	Login screen
13:20	The GM goes out for lunch and signs in again on the same laptop after an hour. No code: this browser was trusted for 24 hours when he verified this morning.	Login screen, trusted browser
15:45	A cashier tries to change the dates on a reservation. The server refuses, because a custom role with View only on Reservations is read-only everywhere, not just hidden in the menu.	Reservations
17:30	The owner reviews the day. The changes to each person’s access are recorded with who made them and for whom, and every sign-in code issued, accepted or refused is in the audit log.	Audit log

Two ideas are at work here. Custom roles decide what each person may do once inside. Sign-in codes make it harder for someone else to get inside as a manager in the first place. The basic reasoning for individual accounts is in our guide to hotel staff roles and permissions; this article covers the newer controls on top of it.

How do custom roles work in Frontdesko?

The role you pick when adding a person is a starting template. The access grid beneath it shows exactly what that role can do and lets you change any box. The role fills in the defaults; once you change a box the person is on a custom role. Changing the role again refills the grid with that role’s defaults, and Reset to role returns a custom person to the template.

Group	Modules	What you can set
Full access grid	Reservations, Guests, Rooms & Room Types, Rates & Inventory, Billing & Payments, Housekeeping	View, Add, Edit and Delete as separate boxes. Any write permission automatically includes View.
View-only	Dashboard, Reports, Financial Reports, Booking Reports, Daily Summary, Audit Log	View only.
Single switches	Run Night Audit, Import Bookings, Write Off Balances, Hotel Settings, Manage Staff	On or off.

What custom roles do not do

They are not time-limited or shift-based, and they do not change by day or shift. Access stays until you change it or deactivate the account.
Server-side enforcement of Add, Edit and Delete applies to people on a custom matrix. People left on a plain role keep that role’s existing behaviour, so apply a custom role wherever you want read-only to be strict.
A copy is a one-time copy. Editing the cashier you copied from does not change the person you copied to.
Changing anyone’s access is done by administrators in Staff Management. The manager role does not hold “Manage Staff” by default.

How do emailed sign-in codes work?

Anyone who can change money, prices or people has to type a one-time code after the password. The code is six digits, emailed to the account’s own address, and valid for ten minutes. Lower-privilege roles sign in as before.

Question	Answer
Who is asked for a code?	Administrator, manager and finance manager roles, plus platform staff accounts. Front desk, housekeeping, maintenance and sales roles sign in with the password alone.
Where does the code go?	To the email address on that person’s own account, not to a shared owner inbox.
How long is it valid?	Ten minutes. It stops working after five wrong guesses or after first use.
How many codes can be requested?	Five per account in any fifteen minutes. After that the screen says to try again later.
How often do I type one?	Once a day per browser. After a correct code the browser is trusted for 24 hours.
How long do sessions last?	Sign-ins for these roles last 24 hours rather than the usual seven days.
Where does the code step appear?	The staff PMS, the hotel admin panel and the POS login.
What if the email cannot be sent?	The sign-in fails closed: no code, no access.
What is recorded?	Issued, accepted and refused codes all write an audit entry with the sign-in’s IP address.

What sign-in codes do not do

An elevated account with no email address on file signs in with the password alone, and the skip is written to the audit log. Add an email to every administrator, manager and finance account, otherwise they never get the second step.
The code protects the sign-in, not the person. Someone who controls the mailbox receives the code, so protect those mailboxes too.
Hotels cannot switch the code off from their own settings. A waiver exists only on the platform side, so that a stolen hotel-admin password cannot disable its own second factor.
It is not an authenticator app or a hardware key. The second factor is email.

How do you roll out custom roles and codes?

Add or confirm an email address on every administrator, manager and finance manager account first. Test one sign-in to see the code step.
List the people who touch the system and what each really needs; the role table in the staff roles guide is a good starting point.
Create each person in Staff Management with the closest role. Only change boxes where the job genuinely differs, such as View-only Reservations for a cashier.
Build one custom person carefully, then use Copy permissions from… for the others in the same job.
Keep “Manage Staff”, “Write Off Balances” and “Hotel Settings” for one or two people.
After a month, review the audit log and tighten or loosen. Remove access on the day someone leaves.

Handling guest card data adds a further reason to limit who can charge a card; see the card guarantee guide. For the privacy side, read GDPR compliance for hotels and our security overview.

Frequently Asked Questions

Can I create custom staff roles in Frontdesko?

Yes. Pick a base role when you add someone and the access grid fills with its defaults. Change any box, such as removing Edit on Reservations, and the person is on a custom role. Reset to role returns them to the template.

What can be controlled in a custom role?

View, Add, Edit and Delete on reservations, guests, rooms, rates, billing and housekeeping; view-only access to the dashboard, reports and audit log; and on-off switches for night audit, imports, write-offs, hotel settings and staff management.

How do I give a new employee the same access as a colleague?

Open the new person in Staff Management and choose Copy permissions from, then pick the colleague. The grid copies across and you save. It is a one-time copy, so later changes to the colleague do not carry over.

Is a read-only role really read-only?

For people on a custom role, yes. Add, Edit and Delete are enforced by the server on the staff API, so a person with only View on Reservations cannot save a change to a booking. People left on a plain role keep that role’s existing behaviour.

Who has to enter an emailed sign-in code?

Administrator, manager and finance manager accounts, plus platform staff. Front desk, housekeeping, maintenance and sales roles sign in with a password only. The code is six digits and goes to the address on the account.

How often do I need to enter the sign-in code?

Once a day per browser. After a correct code the browser is trusted for 24 hours, and sign-ins for these roles last 24 hours. Codes are valid for ten minutes and can be requested five times in fifteen minutes.

What if a manager account has no email address?

It signs in with the password alone and the skip is written to the audit log. Add an email address to every administrator, manager and finance account so they get the code step.

Can a hotel turn the sign-in code off?

Not from its own settings. A waiver exists only on the platform side, so that a stolen hotel-admin password cannot switch off its own second factor.

Give Every Person Exactly the Access Their Job Needs

Add a staff account in the demo, tick a custom role, and watch the access grid and the sign-in step.

Start Live Demo Security at Frontdesko

Related Guides

Access control and accountability