Start from ready roles (manager, cashier, waiter, kitchen, accountant, storekeeper…) or build your own. For every module choose exactly what a role may view, create, edit or delete, and limits like maximum discount.
Nobody can grant permissions they do not have themselves, and changes take effect immediately on every device.