1. Features & Use Objectives
Module Function: The Permission Settings module provides centralized system-level permission management specifically for iMin-branded devices. It includes, but is not limited to: cashbox control permissions and third-party app installation restrictions. Once configured via the KC console, devices will automatically pull and apply the settings through the KiwiCloud interface, enabling consistent policy enforcement.
This module is particularly suitable for enterprise users with strict compliance requirements, allowing uniform control over device capabilities and reducing operational risks from unauthorized actions.
Currently Supported Devices:
Only available for iMin-branded devices;
Permission policies are pulled automatically by the device, without admin intervention;
Cashbox test function must be used together with the “Cashbox” feature in the iMin Device Manager app.
Primary Actions:
Configure cashbox test permissions;
Manage third-party app installation permissions (disable);
Secondary Actions:
Manage third-party app installation permissions (enable).
Typical Use Cases:
Prevent unauthorized installation of third-party apps on business terminals to ensure system stability;
Test POS cashbox open/close functionality;
Apply differentiated permission strategies based on store or branch requirements;
Quickly respond to security incidents by tightening device permission controls.
2. Primary Operations
2.1 Cashbox Test
Description
The Cashbox Test function allows remote configuration of whether a device is permitted to execute local commands to open the cashbox. This setting is configured via the KC console, and the device retrieves and applies it through the Device Manager app. It is primarily used to test whether the connected cashbox can be successfully opened, ensuring hardware connectivity and command compatibility.
The system provides three control options:
Not allowed to open (default): The device cannot open the cashbox via the "Open Cashbox" button in Device Manager;
Allowed to open: The device can directly open the cashbox by tapping "Open Cashbox" in Device Manager;
Open via command: The device requires input of a correct command (default: 16-20-0-0-0) in Device Manager to execute the open cashbox action.
Steps
Go to [Permission Settings] > [Cashbox Test] tab;
Select the target mode: Not Allowed / Allowed / Open via Command;
If "Open via Command" is selected, enter a 5-part numeric command (only 2-digit integers allowed);
Click [Save] to apply the configuration. The device will automatically fetch the new settings from KC.
Notes
Cashbox test settings are only applicable to iMin devices that are connected to KiwiCloud and running the Device Manager app;
Devices must be online to successfully pull configuration from KC;
Command input supports five segments, each being an integer between 0 and 99;
If the cashbox is not properly connected to the device, open commands will fail;
Local access path on the device: Home > Tools > Device Manager > Cashbox.
2.2 Third-Party App Installation (Disabled)
Description
When the Third-Party App Installation setting is configured as Disabled, iMin devices will be restricted from installing non–iMin Store apps, except those defined in a configured allowlist. Only allowlisted devices or scopes will be allowed to install third-party APK packages.
In the disabled state, the following three types of allowlists can be configured to define the allowed installation scopes:
Device Allowlist: Allows specific devices (by SN) to install any third-party app;
App Allowlist: Allows all devices to install specific third-party apps;
Model/Group Allowlist: Allows devices under certain models or device groups to install any third-party app.
Allowlist entries are added via the [Add Allowlist] operation. Single or multiple entries can be added. You can delete entries individually or in bulk.
⚠ If no entries are configured in any of the three allowlist types, third-party app installation will be completely disallowed. Only official apps from iMin Store can be installed.
Steps
1. Set to "Disabled"
In the "Third-Party App Installation" section, select the Disabled option;
The allowlist management interface will appear, allowing you to add devices, apps, or scopes.
2. Add Device Allowlist
Switch to the Device Allowlist tab, click [Add to Allowlist];
In the popup window, select the desired device SNs and click [Confirm];
After adding, these devices will be allowed to install any third-party APK.
3. Add Application Allowlist
Switch to the Application Allowlist tab, click [Add to Allowlist];
In the popup window, select the third-party app (App Name + Package Name) to allow, and click [Confirm];
Once added, all devices will be allowed to install this specific app.
4. Add Model/Group Allowlist
Switch to the Model/Group Allowlist tab, click [Add Allowlist];
In the popup window, select the device Model or Group, then click [Confirm];
Devices under the selected scope will be allowed to install any third-party app.
5. Delete Allowlist Entries
On any allowlist tab, click the [Delete] button on each record;
Or select multiple entries and click [Batch Delete].
Notes
This setting only takes effect when Third-Party App Installation is set to Disabled;
The three allowlist types are complementary—meeting any one condition will allow installation;
Add/delete operations take effect immediately. Devices will pull updated permissions from KC;
This permission policy is only applicable to iMin devices.
3. Secondary Operations
3.1 Third-Party App Installation (Enabled)
Description
When the Third-Party App Installation switch is enabled, all devices are allowed to directly install any third-party APK packages without requiring configuration of device or app allowlists.
This option is suitable for scenarios where no restrictions are needed on installation permissions, such as internal testing or development phases.
Steps
Open the Permission Settings Page
In the left menu, click [Configuration Management] > [Permission Settings], and switch to the Third-Party App Installation tab.
Select "Enable"
In the "Third-Party App Installation" section, click the Enabled radio button.
Confirm the Action
A confirmation popup will appear: "Are you sure you want to enable this setting?"
Click [Confirm] to proceed;
Once enabled, all devices will immediately gain installation permissions.
Notes
When enabled, the system will ignore all allowlist restrictions, and all devices can install any APK;
If you later need to restrict app installation again, switch to Disabled and configure the corresponding allowlist;
This setting applies only to iMin devices; non-iMin devices are unaffected;
After configuration changes, devices will synchronize the latest permissions via the KC interface.
4. Configuration Item Description
Configuration Item | Type | Values / Description | Applicable Scope |
Cashbox Control Mode | Radio | - Not allowed - Allowed - Open via command | Cashbox Test, iMin devices only |
Cashbox Command | Array | Default: 16-20-0-0-0; editable; supports five integers between 0–99; max 2 digits per segment | Only applicable when "Open via command" is selected |
Third-Party App Permission | Radio | - Enabled: All devices can install any APK directly - Disabled: Only allowlisted devices can install third-party apps | Third-party app control |
Device Allowlist | Multi-select | Select registered KC device SNs; these devices can install any APK app | App install control - Disabled state |
App Allowlist | Multi-select | Select third-party apps (including name + package name); all devices can install these apps | App install control - Disabled state |
Model/Group Allowlist | Multi-select | Select one or more device models or groups; devices in these scopes can install any APK | App install control - Disabled state |
Additional Configuration Rules
Cashbox control and third-party app installation permissions are global settings; changes will be actively pulled by devices and take effect immediately;
All configuration items apply only to iMin devices; other brands are not affected;
When third-party app installation is enabled, all allowlist settings become invalid;
When installation is disabled, the three allowlist types are complementary — meeting any one condition grants installation permission;
If a allowlist entry is deleted, the corresponding device or app will immediately lose installation permission and must be re-added to restore access;
The cashbox command only applies to the "Cashbox" feature in the Device Manager App and is not applicable to other apps.