Written by DROPS.ST.
Grant access after someone demonstrates the work, recognizes when to stop and explains the handoff. Watching a demonstration helps preparation; the access decision needs evidence of practical readiness.
DROPS connects products, stock, Customer Accounts and orders. Website and connected Telegram shopping share the catalogue and order system, so training can follow common business records rather than separate channel copies.
Decide the responsibility first
Name the person’s normal tasks and the decisions they must refer to someone else. Answering a status question is different from cancelling an order. Preparing a description correction is different from applying it.
Allocate permissions deliberately using least privilege. OWASP Authorization Cheat Sheet.
Check the complete scope: current DROPS catalogue editing also permits customer-account edits and wallet adjustments. If that exceeds the intended job, let the trainee prepare a request while an authorized editor applies the change.
Use a readiness card
This owner-managed record does not assume a built-in training system.
| Card field | What to record | Decision it supports |
|---|---|---|
| Responsibility | Specific task being assessed | Defines the intended job |
| Demonstration | Fictional case and observed actions | Shows practical readiness |
| Stop point | Condition requiring help or approval | Sets the independent decision boundary |
| Access scope | All actions allowed by the proposed permission | Reveals powers beyond the task |
| Reviewer and outcome | Approved, supervised practice or not ready | Names the access decision owner |
| Review trigger | New duties, changed controls or an unresolved mistake | Keeps approval current |
“Trained on orders” is too vague. Record the demonstrated task and the permissions accepted.
Practise the job, then change the case
Start with the customer’s journey and the records staff use. Show how to identify the relevant product, order and next action.
Use fictional material in an agreed demonstration environment, or written cards when safe interactive practice is unavailable. Training should not need real customer histories, funded payments or customer messages. A trainer can demonstrate restricted actions without sharing their login.
Ask the trainee to perform or explain one ordinary task, then introduce a variation: missing information, a conflicting quantity or an action outside their authority. They should identify what changed and who needs to decide.
A person who succeeds only by repeating the demonstrated example still needs assessment of the decision itself.
Record one of three outcomes
Approved for the defined responsibility: the trainee identifies the correct record, completes the permitted task, recognizes the stop point and explains the handoff. The reviewer also accepts the full permission scope.
Further supervised practice: the person needs prompting or misses a check. Record the remaining skill and next exercise; do not broaden access merely to make practice easier.
Not yet ready: the person chooses a harmful action, cannot identify the record or fails to seek the required decision. Revisit the explanation before reassessment.
A training pass and a permission grant are separate decisions. A capable employee may still have no need for every action grouped under a permission.
Repeated routine approvals can prompt a readiness review. Use demonstrated reasoning, the stop point and the complete permission scope to decide what can be delegated; consequential actions still need the appropriate authority.
Hypothetical example: a useful skill, broader access
A new shift lead finds a fictional order, explains its status and prepares a clear question for the owner. They also identify an incorrect product description.
The owner approves order support but does not grant catalogue editing solely for description corrections, because its customer-account and wallet powers exceed that duty. The trainee sends corrections to a named editor. The readiness card records who prepares and who applies changes.
This is a hypothetical assessment, not a customer result or automatic DROPS training gate.
Review approval when duties change
Inspecting orders does not establish readiness for refunds, cancellations or payment decisions. DROPS has separate order-action controls, while shop settings require administrator access. Match the next responsibility to both training and actual permissions.
Use the manager access checklist to review that scope. Keep the employee offboarding checklist with the access records for later changes or departures.
Train around connected shop work
DROPS gives staff a common working system for product information and customer-linked orders. Use a specific readiness card to turn that context into a deliberate responsibility and access decision.
See the shop and explore demo shops. Bring one role, demonstrate its ordinary task and stop point, and agree the complete access scope before independent work begins.