A shift-tracking and billing system for a service business that pays workers by the hour and bills clients for the same hours. Sign in as any of the four people below — the data is identical, what you are allowed to see is not.
Enforced by row-level security in the database — not by hiding buttons in the browser.
| Capability | Admin | Manager | Worker | Client |
|---|---|---|---|---|
| See every shift | ✓ | ✓ | own only | own accts |
| See hours & output figures | ✓ | ✓ | own only | own accts |
| Approve or reject a shift | ✓ | — | — | — |
| Correct a submitted figure | ✓ | — | — | — |
| See what the client is billed | ✓ | — | — | own only |
| See what the worker is paid | ✓ | — | own only | — |
| See the margin | ✓ | — | — | — |
| Mark a shift paid | ✓ | — | — | — |
| Add or disable people | ✓ | — | — | — |
Access control is the part you can see in thirty seconds. It sits on top of the rest of the system, which is where the actual hours went.
Workers submit from a chat app they already have open — a guided form with typo-tolerant search across ~500 client accounts, timezone-aware time parsing, and photo proof attached to the record.
Every submission is written to a durable log before anything else happens, then processed idempotently with automatic retries. A worker's shift survives an outage on any part of the system.
Impossible durations, overlapping shifts, output-per-hour outside the expected band, figures that move backwards — flagged for review automatically rather than found three months later in a spreadsheet.
Client rates and worker rates are separate, dated records. Raise a rate in March and February's invoices still reprint exactly as they were sent. History is never rewritten.
A Gantt view by week, day or custom range, with search and paging — plus one-click Excel and PDF exports for whoever still wants the file. The manual tallying it replaced took a full evening a week.
Every correction records who changed what, from what to what, and why — the reason is mandatory. Nothing is ever truly deleted, so a dispute six months later is a query, not an argument.
Per-account sliding-window limits checked before anything is written, forged requests rejected on signature, and suspicious patterns alerted with a throttle — so the alert channel stays worth reading.
Serverless throughout — no always-on machine to pay for or patch. The whole system runs inside free tiers at this volume, which is the difference between a tool that gets built and one that gets budgeted.
If two people in your company should not see the same numbers, that rule belongs in the database — not in a spreadsheet tab you remember to hide before the meeting.