Hello community,
I am reaching out to see if any other business owners are experiencing a critical security issue with the Manager Bot integration on Square POS.
Currently, the bot appears to completely bypass role-based access controls and team permissions. Even when logged in under restricted employee profiles using personal passcodes, employees can still access the Manager Bot. Through the bot, users are able to pull up sensitive account information, including:
Full financial and sales reports
Employee details and payroll data
Banking and payout information
There does not appear to be an option to set a PIN/passcode override specifically for the bot, nor a way to restrict its visibility by staff role.
Has anyone found a setting in the Dashboard to disable or restrict access to the bot for standard team members? If a Square team member is reading this, please advise on how to enforce strict owner-only permission controls for AI/assistant features.
Thanks for any insights or workarounds!
