Who can approve your staff’s holiday
Our rota code let a manager name anybody when approving time off, and never asked which venue that person worked at. Nine routes went through one helper. Here is why approving somebody else’s holiday is not a read, and what we changed.
A food hall is a lot of small businesses sharing a roof. The person running the noodle counter and the person running the coffee bar both need a manager account, and neither should be able to touch the other one’s staff. That is obvious enough to say in a sentence. It is harder to be sure of in code, because the check is not in one place — it is in every place somebody can name a person.
We spent a night on that question and found a helper in our rota code with a comment on it that read, near enough: a manager may name somebody; anybody else gets themselves. That was the whole of the rule. It loaded the staff member by their id and handed them back. It never asked which kitchen they worked in.
One helper, nine screens
The thing that made it worth a night rather than an hour is that nine different routes shared that helper — pay, clock-ins, availability, time off, holiday. So the same missing clause meant somebody else’s pay could be read, and their availability and time off written, across kitchens, across halls, across companies.
We fixed it in the helper rather than in nine handlers, for the reason our own code comments keep repeating: a rule written into nine places is the rule the tenth forgets.
The half that was not covered
Then the same night turned up five more routes that do not go through that helper at all, because they name a row rather than a person — a shift, an offer of cover, a time-off request, an availability change. Same missing clause, different door.
The one that matters most there is approving holiday. Approving is not reading. It writes the hours onto the request, which is what comes off the person’s entitlement, and it records who decided it. Another hall’s manager could have spent a stranger’s holiday and been named as having done it.
What an operator should take from this
Two things worth checking in whatever you run, ours included.
Ask whether the refusal tells the truth. When somebody is refused, does the system say “not found” or does it say “not yours”? “Not yours” confirms the person is real and hints where they work. We answer both cases with the same “nobody by that id”, deliberately.
Ask what an approval writes. Anything that spends an entitlement, moves a shift between people, or sets somebody’s sign-in should be treated as a change to that person’s record, not a manager convenience. If your system treats approving as a lightweight action, that is where to look first.
None of this was exploited. Our rota tables were empty when we found it — nobody has written a rota on the live system yet — which is the cheapest possible time to find something and no reason at all to call it smaller than it was.