Assistant Role

​

Overview

• Manage the full studio schedule for all artists
• Handle client intake and information
• View financial reports and transactions
• Check inventory levels
• Perform sensitive actions with master code elevation

​

Core Capabilities

​

Agenda Management (Full Access)

("agenda", "view"):     {"assistant": "allow"}  # View all appointments
("agenda", "create"):   {"assistant": "allow"}  # Book for any artist
("agenda", "edit"):     {"assistant": "allow"}  # Modify appointments
("agenda", "cancel"):   {"assistant": "allow"}  # Cancel appointments
("agenda", "complete"): {"assistant": "allow"}  # Mark completed
("agenda", "no_show"):  {"assistant": "allow"}  # Mark no-shows
("agenda", "block"):    {"assistant": "allow"}  # Create blocks
("agenda", "export"):   {"assistant": "allow"}  # Export schedule

• Book walk-in appointments
• Confirm upcoming appointments via phone/text
• Reschedule appointments due to artist availability
• Mark appointment outcomes (completed, no-show, canceled)
• Block time for events, meetings, or closures
• Print daily schedules for each artist

​

Client Database (Read + Create)

("clients", "view"):    {"assistant": "allow"}   # View all clients
("clients", "create"):  {"assistant": "allow"}   # Add new clients
("clients", "edit"):    {"assistant": "locked"}  # Edit requires master code
("clients", "delete"):  {"assistant": "locked"}  # Delete requires master code
("clients", "consent"): {"assistant": "allow"}   # Manage consent forms
("clients", "notes"):   {"assistant": "allow"}   # View all notes
("clients", "export"):  {"assistant": "locked"}  # Export requires master code

• Search and view client information
• Create new client records during intake
• Attach consent forms to appointments
• View client notes from all artists

• Correct errors in client information (phone, email, etc.)
• Delete duplicate or test clients
• Export client lists for marketing

​

Staff and Portfolio (View Only)

("staff", "view"):          {"assistant": "allow"}  # View all staff
("staff", "manage_users"):  {"assistant": "deny"}   # Cannot manage users
("staff", "toggle_active"): {"assistant": "deny"}   # Cannot disable accounts
("portfolio", "view"):      {"assistant": "allow"}  # View portfolios
("portfolio", "edit"):      {"assistant": "deny"}   # Cannot edit portfolios
("portfolio", "upload"):    {"assistant": "deny"}   # Cannot upload images

• Show portfolios to walk-in clients
• Check artist specialties when booking
• View artist contact information
• Reference artist availability schedules

​

Financial Reports

("reports", "view"):        {"assistant": "allow"}   # View all reports
("reports", "export"):      {"assistant": "locked"}  # Export requires code
("reports", "view_tx"):     {"assistant": "allow"}   # View transactions
("reports", "refund_void"): {"assistant": "locked"}  # Refund requires code
("reports", "cash_close"):  {"assistant": "locked"}  # Cash close requires code

• View daily/weekly/monthly revenue reports
• Check individual transaction details
• Verify payment status of appointments

• Process customer refunds
• Void incorrect transactions
• Close cash drawer at end of shift
• Export financial data for accounting

​

Inventory

("inventory", "view"):        {"assistant": "allow"}   # View inventory
("inventory", "create_item"): {"assistant": "locked"}  # Add item requires code
("inventory", "edit_item"):   {"assistant": "locked"}  # Edit requires code
("inventory", "stock_in"):    {"assistant": "locked"}  # Receive requires code
("inventory", "stock_adj"):   {"assistant": "locked"}  # Adjust requires code
("inventory", "cycle_count"): {"assistant": "locked"}  # Count requires code
("inventory", "export"):      {"assistant": "locked"}  # Export requires code

• Check if supplies are in stock
• View reorder points and alerts
• Look up product SKUs and pricing

• Process supply deliveries
• Adjust quantities for discrepancies
• Add new inventory items
• Conduct physical inventory counts

​

Security Settings (No Access)

("security", "settings"):    {"assistant": "deny"}  # Cannot access settings
("security", "audit"):       {"assistant": "deny"}  # Cannot view audit logs
("security", "backup"):      {"assistant": "deny"}  # Cannot manage backups
("security", "rotate_code"): {"assistant": "deny"}  # Cannot change master code

​

Master Code Elevation

​

How It Works

1. System prompts for master code
2. Assistant enters the studio’s master code
3. Code is verified against hashed value in settings
4. If correct, assistant is elevated for 5 minutes
5. During elevation window, all locked actions are allowed
6. Elevation expires automatically after timeout

def verify_master_code(plain: str, db: Session) -> bool:
    row = db.query(Setting).filter(Setting.key == SETTING_KEY).one_or_none()
    if not row or not row.value:
        return False
    return auth.verify_password(plain, row.value)

def elevate_for(user_id: int, minutes: int = 5) -> None:
    _elevations[user_id] = datetime.now() + timedelta(minutes=minutes)

​

Checking Elevation Status

if is_elevated_now(user.id):
    # Show "Elevated" badge with countdown timer
    # Allow access to locked actions
else:
    # Show "Standard" badge
    # Prompt for master code on locked actions

​

Actions Requiring Master Code

def assistant_needs_code(resource: str, action: str) -> bool:
    return _policy_for("assistant", resource, action) == "locked"

​

Elevation Timeout

# Default: 5 minutes
elevate_for(user_id=user.id, minutes=5)

# Check if still elevated
if is_elevated_now(user.id):
    # Elevation is still active

​

Elevation Workflow Example

1. Assistant navigates to transaction in Reports
2. Clicks “Refund” button
3. System detects reports.refund_void is locked
4. Modal prompts: “This action requires master code”
5. Assistant enters master code
6. System calls verify_master_code(plain, db)
7. If valid:
   • Calls elevate_for(user.id, 5)
   • Allows refund to proceed
   • Shows “Elevated” badge with 5-minute timer
8. Assistant can process additional refunds within 5 minutes
9. After 5 minutes, elevation expires automatically

​

Security Considerations

• Never share the master code with clients or unauthorized staff
• Never write down the code where clients can see it
• Don’t remain elevated longer than necessary
• Log out when leaving the desk unattended
• Report suspected code compromise to admin immediately

• Rotate master code every 90 days
• Change code immediately when assistant leaves
• Monitor audit logs for elevation patterns
• Investigate suspicious elevated actions

​

What Assistants Cannot Do

​

Never Allowed (Even with Master Code)

("staff", "manage_users"):  {"assistant": "deny"}
("staff", "toggle_active"): {"assistant": "deny"}

("portfolio", "edit"):   {"assistant": "deny"}
("portfolio", "upload"): {"assistant": "deny"}

("security", "settings"):    {"assistant": "deny"}
("security", "audit"):       {"assistant": "deny"}
("security", "backup"):      {"assistant": "deny"}
("security", "rotate_code"): {"assistant": "deny"}

​

Daily Workflows

​

Opening the Studio

1. Log in with assistant credentials
2. Review today’s schedule for all artists
3. Check for appointment confirmations needed
4. Review any notes from previous shift
5. Verify inventory of commonly used supplies
6. Prepare consent forms for first appointments

​

Booking a Walk-In

1. Search for existing client or create new:
   • Client name, phone, email
   • No master code needed for creation
2. Check artist availability in agenda
3. Create new appointment:
   • Select artist, date, time
   • Choose service type and duration
   • Add any special notes
4. Have client sign consent form
5. Collect deposit if required

​

Handling a Refund Request

1. Navigate to Reports > Transactions
2. Find the payment transaction
3. Click “Refund” button
4. System prompts for master code
5. Enter master code (elevates for 5 minutes)
6. Complete refund form:
   • Refund amount (full or partial)
   • Reason for refund
   • Refund method (original payment method)
7. Confirm refund
8. Print receipt for customer

​

Closing Cash Drawer

1. Navigate to Reports > Cash Close
2. System prompts for master code
3. Enter master code (elevates for 5 minutes)
4. Review expected cash amount
5. Count physical cash in drawer
6. Enter actual cash amount
7. System calculates overage/shortage
8. Add notes if there’s a discrepancy
9. Submit cash close report
10. Print report for manager review

​

Processing Supply Delivery

1. Navigate to Inventory
2. Click “Receive Stock”
3. System prompts for master code
4. Enter master code (elevates for 5 minutes)
5. Scan or enter items received:
   • Product SKU or name
   • Quantity received
   • Lot/batch number if applicable
6. Verify against packing slip
7. Submit stock receipt
8. File packing slip for accounting

​

Tips for Assistants

​

Related Resources