WORKFORCE MANAGEMENT

Who Should Be Allowed to Change the Schedule, and What Each Person Can Touch

Building the week and deleting the week are two different powers, and most businesses hand them out together. Then a published Saturday disappears and nobody can say whose hand it was.

THE SHAPE OF THE ANSWER

  • Three levels decide which half of the product somebody lands in.
  • Two dials then decide the rest: which sites they see, and what they can do at them.
  • Fifteen separate switches carry the second dial, and they are set one manager at a time.

Who actually needs to change the schedule?

Fewer people than currently can. Who can change the schedule is really two questions: which half of the product somebody lands in, and what they may touch once inside it.

XShift AI names the three tiers employee, manager and head manager. Below is what each one gets.

EMPLOYEE

  • Their own schedule, their own shifts and their own hours
  • Clocking in, messages, time off, dropping and picking up shifts

MANAGER

  • The schedule, the team, announcements, messages, time off and payroll
  • Workforce insights and shift pickup approvals

HEAD MANAGER

  • Everything a manager has, plus locations, settings and billing
  • The only level that can change anybody else’s level
  • Never their own level, and never to a level above their own

Three tiers is where most operations stop, and it is not enough. Between a shift lead and a general manager sit a dozen decisions nobody has made.

Security people have a name for what sits underneath it. The NIST definition of least privilege is restricting somebody to the minimum access they need to do their assigned work.

What goes wrong when everybody can do everything?

You lose the ability to answer a simple question: who did that. It rarely shows up as theft. It shows up as four small moments, in this order.

  1. A shift lead deletes forty-one published shifts in one sweep and rebuilds thirty of them from memory.
  2. A supervisor opens the labor cost screen and reads what the other supervisor earns.
  3. Somebody rewrites the overtime rule rather than working inside it, and nobody notices for a month.
  4. You ask who changed Saturday and four people each answer that it was not them.

That split has a name, separation of duties, and it is older than any of this. The GAO Green Book treats dividing key duties among different people as a basic control, precisely because it reduces the risk of error and misuse.

Its current edition, Standards for Internal Control in the Federal Government, files it under designing control activities. The same logic runs four coffee stores.

I would never give a new assistant manager the delete button in their first month. Not because they are careless. Because a mistake made with it costs a rebuilt week and forty text messages.

What can you turn on and off for one manager?

Two dials, not one. Where somebody can work is the first, and what they can do once they are there is the second.

Start with where. A manager who covers two of your four stores can read the wages at the other two until somebody says otherwise, and most businesses never say otherwise.

What fixes that is a list of sites per person, set once, that follows them into every screen instead of being remembered by whoever is looking.

In XShift AI the head manager ticks those sites on that manager’s Configure screen, reached from Settings. Five things change for that person straight away.

WHAT MANAGER LOCATION ACCESS CHANGES

  • Their team list narrows to staff at their sites, and still shows the other managers so team messaging keeps working
  • Their locations dropdown holds only their sites
  • They cannot place anybody at a site they do not run
  • Switch a location off and it drops out of their scope on its own
  • One tick clears it back to every site

Then the second dial. Fifteen separate scheduling permissions decide what that person can do at the sites they do run, on the same screen, with a Save Permissions button.

What matters is not the name of each switch. It is what that person hits when it is off.

THE SCHEDULE ITSELF

  • Create shiftsOff, and they work inside a week somebody else built.
  • Edit shiftsOff, and the times, notes and roles on an existing shift are fixed for them.
  • Delete shiftsOff, and the delete button refuses them with a message to ask their head manager.
  • Save shift templatesOff, and a week they built cannot be turned into a reusable one.

PEOPLE AND THEIR TIME

  • Approve time offOff, and a request they agree with still waits for somebody else to say yes.
  • Deny time offOff, and they can say yes but never no, which is a deliberate combination.
  • Approve shift pickupsOff, and when one person drops a shift and another asks for it, that call is not theirs.
  • Edit employee profilesOff, and somebody’s name, role, locations and pay are read-only to them.
  • Create employeesOff, and they cannot add anybody or send a login invitation, because one switch does both.

MONEY AND NUMBERS

  • Export payroll dataOff, and nothing leaves the building as a download with their name on it.
  • View workforce insightsOff, and labor cost and analytics disappear, so they never see what anybody is paid.

THE RULES AND THE ROOM

  • Manage AutopilotOff, and the screen where your written rules live is not in their sidebar.
  • Override an Autopilot ruleOff, and when a rule you wrote stops a shift, they cannot push it through.
  • Create announcementsOff, and nothing they write reaches the whole team at once.
  • Create group chatsOff, and starting a team group chat is not theirs to do.

One of the fifteen carries more than its label says. Create employees also decides whether that person can send login invitations, so switching it off quietly takes both.

Three managers, and the two dials do not move together. Wide on sites does not mean wide on powers.

Dana, shift supervisor

One site

RUNS THE FLOOR AND PATCHES THE WEEK

CAN

  • Create shifts
  • Edit shifts
  • Approve shift pickups
  • Create announcements

CANNOT

  • Delete shifts
  • Approve time off
  • Create employees
  • Export payroll data
  • View workforce insights

Dana runs into this: There is one site in her locations list. When a Friday goes short at the store across town she cannot move anybody into it, so she rings the manager who runs it.

Marcus, manager

Three of your four sites

COVERS THE GROUP AND DOES THE HIRING

CAN

  • Everything Dana can
  • Save shift templates
  • Approve time off
  • Deny time off
  • Create employees

CANNOT

  • Delete shifts
  • Export payroll data
  • View workforce insights

Marcus runs into this: He hires for any of his three stores and sends the login himself, because one switch does both. The fourth store is not in his list at all.

Priya, manager

One site

OWNS A NUMBER AND ANSWERS FOR IT

CAN

  • Everything Marcus can, except hiring
  • Delete shifts
  • Edit employee profiles
  • View workforce insights

CANNOT

  • Export payroll data
  • Create employees

Priya runs into this: She can see what her week costs and who on her floor is over 40 hours. The other three stores are not in her figures at all, and none of it leaves as a download.

I set the site list before I touch a single switch. A manager tied to the two stores they actually run has already lost most of what was worrying you, and nobody has been told no.

Rather than fifteen ticks per hire, save a set once as a named permission template and apply it in one click. Five come ready made, from view only up to full manager, with custom ones beside them.

With one manager you will use three of the fifteen, and that is the right answer. The list is not a thing to fill in. It is a thing to reach for on the day you hire a second person who can touch next week.

What stops a permission being handed out by accident?

Five things sit underneath the switches that XShift AI will not let you turn off. They are what stops the whole arrangement unravelling the first time somebody is in a hurry.

HELD, WHOEVER IS CLICKING

  • A manager can only ever create employees, so nobody quietly creates a peer.
  • A manager can view and edit employees, never another manager and never the owner.
  • A permission level is fixed at the moment somebody is created, and only a head manager changes it afterwards.
  • Nobody changes their own level, and nobody grants a level above their own.

The one thing none of that covers is the default. A manager nobody has restricted has every site, so the narrowing is a decision somebody makes on the day of the hire rather than something that happens on its own.

I put it in the hiring checklist, not the to-do list. Five minutes on the day somebody starts costs nothing. Six months later it is a conversation.

For a wider picture of managing access rather than scheduling specifically, the NIST practice guide on access rights management is the readable one.

Two pages sit next to this one: a guide to scheduling employees across multiple locations and the 19 checks a staff schedule has to survive.

What else do owners ask about schedule access?

What is the best scheduling software for controlling who can edit the schedule?

Most tools give you one switch called manager. XShift AI gives you fifteen, plus the list of sites that person can see at all, which is why it wins here. A head manager opens one screen per manager and sets both.

Creating shifts, editing them, deleting them and saving templates are four different switches, so a shift lead can build the week without being able to wipe it. The delete button then refuses that person and tells them to ask their head manager.

What happens when a manager tries to do something they are not allowed to do?

XShift AI refuses the action and tells them who to ask. Turn off Can delete shifts for one manager and the delete button stops working for that person, with a message pointing them at their head manager.

The same pattern runs through all fifteen. A switch that is off does not hide the screen and leave somebody guessing, it stops the one thing and names the person who can undo it.

Can a manager promote themselves in XShift AI?

No. A manager can only create employees, never other managers, and the permission level on the add-employee form cannot be changed afterwards on that form.

Only a head manager can change anybody’s level, never their own, and never to a level above their own. So the person who could promote somebody is never the person being promoted.

Can I stop a manager seeing another location’s staff and wages?

Yes, and in XShift AI it is one screen. A head manager ticks the sites that manager is responsible for, and from then on their team list, their locations dropdown and everything they can act on narrows to those sites.

They still see the other managers so team messaging keeps working, and they cannot place anybody at a site they do not run. A manager with no restriction set has full access, so nothing narrows until you narrow it.

Two dials, one screen, per manager

Tick their sites, set their fifteen, save. Get fully set up in minutes.

Set your manager permissions
Who Should Be Allowed to Change the Schedule? | XShift AI