We have discovered that some functions that we thought had been locked down through permissions can actually be performed by anyone mapped to a circ desk. We need to allow these functions through permissions. We discussed options. The first was to have a button appear or not appear depending on whether or not a user had permission to perform that function. The second was to have the button available to all, but for a "you are not permitted" message to appear if the user is not assigned the permission. It turns out that we don't have a preference. It can go either way.
The things we need locked down, and are currently not, are as follows.
In the loan screen, these buttons need to be locked down:
Alter due date
Bill as lost
In the Bill screen, we need these buttons locked down:
These screens should be accessible only to those with permission:
Create bill screen
Edit bills screen