What a food hall till has to hide from the stall next door
In a food hall, several separate businesses share one system. A trader must never see the kitchen next door’s takings, staff pay or supplier prices. Here is what that isolation has to cover, and the quiet way it leaks.
A food hall looks like one venue and is not. Eight kitchens under one roof are eight businesses: eight bank accounts, eight sets of staff, eight VAT positions, and eight people who would each be unhappy to learn a competitor ten feet away can read their numbers off a shared screen.
So the first job of a food-hall POS is not taking an order. It is making sure that when the taco stall signs in, everything the system shows them is theirs and only theirs — sales, rota, hourly rates, supplier cost prices, the lot — and that the kitchen next door is, as far as their login can tell, not there.
The obvious half is easy
Scoping a list is straightforward once you decide to. Every screen that shows rows — today’s orders, the staff list, the stock count — is filtered to the venues this account is allowed to see before a single row is drawn. Ask for another hall’s sales by naming it and the answer is a flat refusal.
The half that leaks is a record reached by its id
The quiet failure is different. A request that says show me venue 7’s takings is easy to check, because it names the venue. A request that says show me order 4192 names nothing — and an order belongs to a venue. So does a staff record, a timecard, a stock transfer between two kitchens. Load one of those by its number and hand it back without asking whose it is, and you have handed one business a window into another’s, opened not by guessing a password but by counting.
The rule that closes it: a record fetched by its id has to prove it belongs to a venue you can already see, and if it does not, it answers exactly as if it did not exist — not “forbidden”, which would confirm the record is real, but “not found”. A trader walking the numbers upward learns nothing, because every id that is not theirs looks empty.
Why it matters more in a hall than a chain
A restaurant group can be sloppy about this internally; every site is the same company. A food hall cannot. The businesses are rivals who happen to share a landlord, and “the system showed me the unit next door’s margins” is how a hall loses a tenant. If you run one, the question worth asking a POS supplier is not “is it multi-site”. It is “when I open a record by its number, does it check whose it is”— and the honest ones can tell you exactly where that check lives.