The code proves who you are. The permission decides whether you may.

Most tills treat the manager code as the whole answer: know the code, approve the comp. That is fine until somebody leaves, and then the code is a liability that everyone still remembers.

Here the code and the permission are different. The code is how a person who is not signed in on that terminal proves which person they are. The permission is your organisation saying that person may approve this. Both have to hold, and the permission is checked first.

So revoking somebody takes one click, applies instantly, and needs no code change, no reissue, and no conversation with the rest of the floor about a new number.

Every override writes down who approved it, who was operating the terminal, what it was against, what it cost and why. The pair matters: "Dana comped it" and "Sam rang it up and Dana approved" are different facts, and only the second one answers a question about a shift.

A dine-and-dash is recorded the same way, as a walkout. It is money written off — the same act as a comp with a different cause — so it lands in the log management already reads instead of a separate report nobody opens.

Wrong codes are counted and the code locks after five. Four digits typed at a counter is ten thousand guesses for anyone with a quiet hour, and the lockout is what stands between that and the drawer.