Harden revoked-staff invalidation with device-bound sessions
Shared store devices make access control visible only when staffing changes expose it.
Strong revocation and uninterrupted checkout can conflict at the edge of connectivity and device timekeeping.
“When someone leaves, I need them out straight away—but service can’t stop.”
Brigitte Roberts · Restaurant Owner
Runs a restaurant with rotating shifts, shared terminals, and frequent temporary staffing changes.
What pulls against what
- rapid revocation vs. uninterrupted checkout
- strict security control vs. unreliable device clocks
- committed migration vs. incomplete validation
- central identity policy vs. terminal edge conditions
What is at stake
The new access model must close a real security gap without turning normal staffing changes into service interruptions. Once the migration begins, reversing it is costly and risky
Why SumUp
For SumUp, this can shape how safely merchants manage staff access without disrupting daily trade.
Written for
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.