# 6. Security & Governance

## Role-Based Access Control (RBAC)

- Setiap aksi (create order, void, refund, config) dicek via **Policy** atau **middleware permission**.
- Role: Super Admin, Outlet Admin, Manager, Kasir, Dapur, dll. Permission granular per fitur (e.g. `order.create`, `order.void`, `report.sales`).
- Multi-outlet: user bisa akses beberapa outlet; filter data per `outlet_id` (dan tenant_id jika multi-tenant).

## Audit Log

- Log untuk: login/logout, create/update/delete order, void, refund, perubahan harga/config.
- Field: user_id, action, entity_type, entity_id, old/new (snapshot atau diff), ip, timestamp.
- Retention & export sesuai kebijakan (compliance).

## Approval untuk Aksi Kritis

- Refund di atas nominal X → butuh approval (workflow atau role).
- Void order → log + optional approval.
- Perubahan config global → audit + optional approval.

## IP & Device Restriction (Opsional)

- Admin panel: batasi IP atau require 2FA untuk role tertentu.
- Device binding untuk POS/KDS jika perlu.

## Soft Delete untuk Data Kritikal

- Order, Payment, Transaction: **soft delete** (deleted_at). Jangan hard delete untuk keperluan audit dan laporan.
- Beberapa master (Product, Outlet) bisa soft delete agar riwayat order tetap konsisten.
