eTIMS Roles and Permissions in Kenya: Setting Them Up Right (2026)

Once more than one person uses your system, who can do what becomes a real question. Roles and permissions are how you answer it: rather than every user having full access, each is given the access their job needs. A cashier rings up sales and issues compliant invoices; a supervisor can also process refunds and pull reports; an owner or admin manages users, products and settings.

This matters for control and for reducing both errors and temptation. A cashier who cannot void or refund freely, or change prices, is less able to cause a costly mistake or a loss, while still doing their job. So the discipline is to match permissions to roles, give people what they need and no more, and keep sensitive functions with supervisors and owners. A system that supports roles makes this straightforward.

The principle worth applying is least privilege: each person gets the access their job needs and no more. That is not about suspicion, it is about narrowing the field when something looks wrong. If only three people can process a refund, a questionable refund has three possible explanations rather than fifteen, and most of them can be resolved with a conversation.

The permissions that actually matter are the ones that move value without a sale: voids, refunds, discounts and price overrides. Selling is the safe permission and everyone needs it. Those four are where losses hide, so they are the ones to restrict, review periodically, and check against the record rather than set once and forget.

A practical path for a Kenyan business.

1. 1

   Define your roles

   Decide your roles, typically cashier, supervisor and owner or admin, and what each should be able to do.

2. 2

   Map permissions to each role

   Give cashiers sales and invoicing, supervisors refunds and reports, and owners or admins user and settings management.

3. 3

   Assign each user a role

   Assign every user the role that fits their job, so they have the access they need and no more.

4. 4

   Review as the team changes

   Update roles when people join, leave or change jobs, so access always matches the current team.

5. 5

   Restrict voids, refunds, discounts and overrides

   These are the actions that move money without a corresponding sale. Everything else can be broadly granted; these should not be.

6. 6

   Review who holds what every few months

   Permissions accumulate as people cover for each other. A short periodic review catches the access that was granted for one afternoon two years ago.

Veira is built for Kenyan businesses. It issues compliant KRA eTIMS invoices automatically on every sale, applies the right tax treatment per item, captures the buyer KRA PIN, keeps your records reconciled and ready for filing, and reconciles M-Pesa and Pochi payments to each sale.

It runs on a free handheld terminal or the phone you already own, keeps working offline, and runs from KES 2,999 a month, terminal included on annual billing and a 30-day money-back guarantee. See how Veira works, or book a free demo.