Read-only guide

READ_ONLY exists for observers: an accountant’s reviewer login, a consultant, an owner’s assistant who should look but never touch. It holds exactly two permissions — reservations.read and reporting.read — and every mutation in the product refuses it with PERMISSION_DENIED (403). The role is granted per venue by an owner, an org admin, or a manager (READ_ONLY is inside the manager grant ceiling).

Sign-in and first screen

Sign in at /app/login (a 6-digit code if two-step verification is enrolled), land on Your venues at /app, and open a venue’s Today’s service board. See Your account & security for sessions, two-step verification and revocation.

What you can see

Surface	What you get
Today board	The full day: every booking’s time, guest, party size, status, code, tables and arrival counts; “Floor right now” occupancy.
Reservation detail	Status, confirmation code, tables, visit state, guest requests — every action button on the page refuses on submit.
Service view	Bookings and floor occupancy for a business date with revision-based auto-refresh.
Message delivery outcomes	Job states and attempts per venue, recipients masked.
SMS gate truth	The reminder switches plus exactly where each capability gate stands.
Provider event inbox	Verified webhook envelopes: safe references and checkpoints only.
Refund intent queue	Demands for money back, with states and approval stamps — statuses, never actions.
Guest search	Identity only — the projection is redacted to contact identity, no notes, no tags, no visit counts.
Operational metrics report	Aggregates only: accepted parties, covers, cancellation split, lead times, waitlist conversion, per-currency money.
Metrics CSV export	The same aggregates as a formula-escaped CSV with an audited purpose.

Reports deserve one note: metrics without an instrumented source (POS spend, online booking conversion, demand lost, resource utilization, actual occupancy) are named unavailable instead of zero-filled, and zero-denominator rates read “not applicable” — Reports & metrics.

What read-only cannot do — surface by surface

The list below is the point of the role. Each item refuses with 403 PERMISSION_DENIED; nothing is hidden, everything is refused.

• Bookings — no walk-in or phone intake, no reschedule, no cancel, no no-show, no reconfirmation request or answer, no request decisions. There is no public cancel path either; every booking mutation needs a staff session with write authority (Making a booking, Changing & cancelling).
• Floor — no arrivals recorded, no corrections, no seating, no complete-and-clear, no moving a party between tables (Arrivals, seating & visits).
• Check-in — no issuing or scanning passes; both need roles this role does not hold (QR check-in passes).
• Waitlist — no offering tables, no accepting or withdrawing offers, no sweeps (Waitlist).
• Guest links — no issuing or rotating a guest’s management link (Guest self-service links).
• Guest CRM — no notes, no tags, no consent evidence; the search already withholds everything but identity (Guest profiles & notes).
• Privacy — no opening, verifying or executing privacy cases, no holds, no retention sweeps (Privacy, retention & deletion).
• Bulk data — no CSV import staging or commit, no venue-wide FUTURE_BOOKINGS export (the metrics CSV above is aggregates-only) (CSV import).
• Messaging — no retrying a failed message, no template preview, no saving reminder settings (Messages, confirmations & reminders).
• Money — no requesting refunds and no payment-status or transaction views; money views belong to the refund-authority tiers (Payments (pilot posture)).
• Setup and team — no venue settings, floor plan, offerings, schedules, policies, publication, invitations or role changes.
• Platform surfaces — platform operations are a separate authority axis no tenant role reaches (Platform operator guide).

How the refusals feel

The console still shows the pages you can read, so the day stays visible; only the writes bounce. A typical refusal reads “This account may not perform that action.” with the PERMISSION_DENIED code — the catalogue is in Error codes & fixes. A venue outside your membership is a plain 404, identical to an unknown venue: existence is never revealed. If you expected write access, the fix is a role change by an owner, org admin or manager — see Roles & what they can do for the whole matrix and Organizations, teams & invitations for how grants are made.