Nobody approves their own requestNot their own load, return, variance or write-off. The person who asks and the person who approves are always different.
Built for every role
Nineteen roles. Four levels. One set of rules.
Field, depot, head office and the Ibex team each get the screens they need and nothing more. Every person works inside a scope, every approval has a limit, and the people who carry stock and cash are never the ones who sign them off.
6 field roles/
5 depot roles/
5 head-office roles/
3 vendor roles
Level 1 — Field
On the route, on an Android phone.
Field users see only their own sales days and their own route's customers. The app shows or hides each screen by role and by the company's plan, so a merchandiser never sees a cash screen and an order booker never issues stock.
- PIN sign-in on a phone bound to the company
- Works all day without signal; syncs when it can
- English, Arabic and Urdu, with right-to-left layouts
Van salesman
The driver-salesman. Starts the day, confirms the load, visits, sells, invoices, takes returns, collects and ends the day.
- Never
- Validates their own load or unload, sells beyond van stock, changes prices, voids invoices or exceeds credit
- Approves
- Standard returns within the rules
Order booker
The pre-seller. Takes orders (not invoices), collects where allowed and does light merchandising. Second release
- Never
- Issues stock or tax invoices
Delivery driver
Delivers pre-booked orders, adjusts to what the shop accepts, collects payment and empties.
- Never
- Adds shops or items outside the day's deliveries
Merchandiser
Shelf audits, photos, surveys, out-of-stock flags and suggested orders. Third release
- Never
- Sells or handles cash
Collector
Collects old balances only, against open invoices, with a printed receipt.
- Never
- Sells or delivers
Helper
Loads and unloads alongside the salesman. Has no sign-in.
- Never
- Invoices or holds cash
Level 2 — Depot
Where stock and cash are counted.
The depot works at a counter in the web app, on a desktop or a 10-inch tablet, with the supervisor and gatekeeper on the phone app. Each depot role is scoped to its own depot.
- Load desk, unload desk and cash desk
- Returned goods inspected: good back to sellable, damaged to quarantine
- Settlement queue with the age of every unsettled day
Depot manager
Runs one depot: people, routes, stock and oversight of settlement.
- Never
- Settles their own cash
- Approves
- Variances above the supervisor's limit, stock adjustments
Route supervisor
Journey plans, the team and ride-alongs. Approves in the field by PIN or one-time code.
- Never
- Edits invoices or collections after they are issued
- Approves
- Loads and unloads, credit and price overrides, new customers, missed visits, van-to-van transfers, small variances
Storekeeper
Loader and checker. Picks against the load sheet, counts out and in, separates damaged goods, signs with the salesman.
- Never
- Approves their own variances, or sells
- Signs
- The load and the unload, with the salesman
Cashier
The settlement accountant. Counts by denomination, receives cheques, closes the settlement and makes the bank deposit.
- Never
- Edits invoices, or writes off a shortage they found
- Does
- Accepts the settlement and raises a shortage for approval
Gatekeeper
Optional. Scans the gate pass, records time out, time in and the odometer.
- Never
- Changes quantities
- Approves
- Gate release
Level 3 — Head office
Policy, credit and the full picture.
Head office sets the rules every handset follows: price lists, credit terms, approval limits and who may do what. A sales manager can be national, regional or area; their scope is set per person, and every report respects it.
- Approval limits per role, set by the company
- Audit log of every approval, override, void and role change
- Surprise van counts by the auditor
Owner / company admin
Company setup, users, roles, approval rules, price lists and credit policy.
- Never
- Edits an issued invoice; it can only be reversed
- Approves
- Write-offs and credit limits above thresholds, price-list changes
Sales manager
Targets, promotions and dashboards for their own territories.
- Never
- Posts cash or stock
- Approves
- Discounts above the slab, non-standard returns, new key-account terms
Finance / credit controller
Credit limits and terms, blocks, the cheque register, ageing and statements.
- Never
- Posts sales
- Approves
- Credit increases and overrides, unblocks, bounced cheques, bad-debt write-off
Analyst / auditor
Read-only reports, surprise van counts and balance confirmations.
- Never
- Changes any transaction
- Signs off
- Audit findings
In-company support
Helps users anywhere in the company, resets PINs and resolves stuck sync documents.
- Never
- Approves money or stock
Principal viewer
An outside brand owner who sees only their own brands' secondary sales and claims. Third release
- Never
- Sees costs, margins or other brands
Level 4 — The Ibex team
Licences, devices and support, from one console.
The Ibex team licenses, bills and supports each distributor from the same vendor console that runs Ibex POS. Vendor roles look after the platform; they never touch a distributor's sales, stock or cash.
Vendor admin
Companies, plans, licences, billing and the vendor team.
- Never
- Touches a company's transactions
Vendor operations
Onboarding, device activation and app releases.
- Never
- Changes billing or the team
Vendor support
Read-only: company health, sync errors and audit events.
- Never
- Changes anything
Separation of duties
The person who carries it never signs it off.
These rules are checked by the server on every request, not just hidden in the screens, and they hold offline too.
Three people around every shortageThe cashier who counts is not the salesman who carried the cash, and neither of them can write off the shortage.
Limits per roleA supervisor may approve variances up to an amount the company sets; above that it goes to the depot manager, then finance.
Every approval is recordedWho, when, why and how much, in an append-only audit log that the auditor can search and export.
Scope on the serverEvery endpoint checks the role's permission and scope. A field user's phone only ever receives their own route's data.
A shared PIN authorises nothingPINs are personal. If two people have the same PIN, it approves nothing; wrong PINs lock sign-in for 15 minutes after five tries.
Approvals with no signal
The salesman never waits for a network to get a yes.
When a sale needs a decision (a credit override, a price below the floor, a return above the limit, an unplanned visit) the salesman asks from the shop. The supervisor answers in one of three ways:
- Online, from the approvals inbox on their phone or the web
- By PIN, typed on the salesman's phone when they are together
- By one-time code, read out over a call: single use, valid for 15 minutes, bound to that action and that amount
What needs an approval
Each one has its own limit.
| Request | Typical approver |
|---|---|
| Credit over limit or overdue | Supervisor, sales manager, finance |
| Price below the floor, discount above limit | Supervisor, depot manager |
| Return above the role's limit | Supervisor, depot manager |
| Load, unload, van-to-van transfer | Supervisor, depot manager |
| Stock or cash variance | Supervisor, depot manager, finance, by amount |
| Invoice void (original kept) | Depot manager, finance, owner |
| New customer, unplanned visit | Supervisor |
| Bounced-cheque unblock | Finance |
Guides for every role
A user guide for each person on the route.
Partners get the product overview and the role guides (salesman, booker and driver, supervisor, storekeeper, cashier and back office) in the partner portal.