Door guide

The door role is deliberately narrow: it sees today’s service and records arrivals, and nothing else. Door staff check guests in off the street or off a QR pass without ever touching guest histories, notes, money or the waitlist. The role exists so a venue can put a tablet or a person at the door with the least authority that still works.

How you get the role

Like every staff role, DOOR is granted per venue by invitation — from an owner, org admin or a manager (managers may grant exactly HOST, DOOR and READ_ONLY). See Organizations, teams & invitations. The live demo includes a Door card (“Watch the floor”) that signs you in instantly on the seeded demo venue.

Sign-in and first screen

Sign in at /app/login (with your 6-digit code if the account uses two-step verification). You land on Your venues at /app and follow Today’s service → to the venue board.

What you can reach

Surface	What you see	What you can do
Today board (/app/venues/{id})	The day’s bookings and “Floor right now”	Read only
Reservation detail	Guest, party, time, status, tables, requests	Record arrival only
Service view (operator panel)	All bookings and floor occupancy for a date, with auto-refresh	Read only
Scanner (operator panel)	Pass look-up result	Scan and commit an arrival
Guest search	Arrival counts only	Nothing — no notes, no contact details

Concretely:

• Record arrivals. From the reservation detail page (“Guests at the door”, partial counts welcome) or from the Arrivals operator form. Both run the same server command; a repeated request key replays the same arrival instead of recording a second one.
• Scan check-in passes. In the Check-in passes / scanner panel, enter the pass token (the QR payload), the arriving count (1 up to the party’s remaining size) and optionally a device id, then Confirm arrival. A pass that belongs to another venue refuses with CHECKIN_PASS_WRONG_VENUE; one outside its scan window refuses with CHECKIN_PASS_WINDOW naming the window. Scanning an already-arrived party answers “Already checked in — nothing recorded again.” See QR check-in passes.
• Watch the floor. The service view lists every booking and every occupied table for a business date and refreshes by revision, so an unchanged floor answers cheaply. Read-only for door: The service board.
• Look up a guest’s visit counts. The guest search shows arrival counts for this venue only — no contact details, no note categories, no history beyond the counts. The full projection story is in Guest profiles & notes.

The scanner is honest about the network

Check-ins are online-only. While the device is offline the scanner shows an amber banner — “Offline — check-ins are online-only. Nothing has been committed or queued; no success is shown without the server.” — and the button disables. There is no local write, no queue and no optimistic “admitted” state; the fallback is to take the arrival by hand (the confirmation code and a count) once the connection is back. Camera capture is not implemented in this pilot: the pass token arrives as typed text or from a paired reader, not from a camera scan. See Offline & installable app.

What a door role cannot do

These are not hidden from you by accident — each refusal is the server enforcing the role, answering PERMISSION_DENIED (403):

• No bookings. Creating a walk-in or phone booking needs reservations.write; door does not hold it (Walk-ins & staff intake).
• No pass issuing. A door session can scan passes, never mint them — issuing needs host or above. A door-issued pass is a contradiction the code refuses.
• No waitlist. Offering tables, accepting offers and sweeping expired offers are host-and-above floor acts; the door never manages the queue (Waitlist).
• No corrections. Changing a recorded arrival count is a manager correction, not a door act (Arrivals, seating & visits).
• No histories, no notes. Guest note bodies, categories and consent ledgers never appear for door; the search shows counts only.
• No money. Payment status and finance views refuse host and door sessions explicitly (Payments (pilot posture)).
• No reports, no exports, no settings. Aggregate reports, bulk imports and exports, privacy cases, staff and venue management are all above the door role’s authority.

What refusals look like

Role gaps answer PERMISSION_DENIED — the scanner’s own text reads “This role may not do that (issuing needs host or above; scanning needs door or above).” A venue you are not a member of is a plain 404, the same answer an unknown venue gives; existence is never revealed. Error codes and their meanings are catalogued in Error codes & fixes, and session basics (7-day sessions, two-step verification, revocation) in Your account & security.