Clocking in a colleague, without rebuilding buddy punching
There's a version of a restaurant that exists in software diagrams, where every member of staff carries a charged phone and scans a QR code on the way in. Then there's the one with a pot wash whose phone is in a locker, a commis who cracked their screen in March, and a Saturday extra who started an hour ago and hasn't been added to anything.
DailyBrew now lets a named person clock a colleague in or out, at the current moment, from their own phone.
We wrote the post arguing against this
The buddy-punching tax is on this same blog, and it's about exactly this: a shift where one person clocks in three friends who aren't there yet costs a real restaurant real money, and the whole point of a QR code on the wall is that the person scanning it is standing in front of it.
Shipping "one employee may punch for another" a few posts later deserves an explanation rather than a feature announcement.
What keeps it from being that
Three constraints, and the feature is only defensible with all three.
The person punching is named. There is no state in which any employee may punch any employee. The owner switches a flag on for one specific person, and that flag is the only route in — being the owner doesn't grant it, and neither does holding the attendance permission. Those cover writing an attendance row at a desk, which is an auditable correction. Standing at the door punching colleagues in is a different act, and it gets handed out deliberately rather than inherited.
They have to actually be there. This is the part that does the work. The workspace's location and network checks still run — they just run against the person tapping the button, not the colleague being clocked in. Testing the absent colleague's position would be meaningless, since the entire premise is that they aren't holding a phone. So a shift lead can punch the crew in from the pass, and cannot punch anyone in from the bus.
The row says who did it. Every proxy punch stamps the same audit fields a manual correction does. It renders with the "Edited" treatment and names the person who made it. A proxy punch never passes for a self-scan, on any screen or in any export.
Buddy punching is someone clocking in a friend who isn't there. Each of those three is aimed at a different part of that sentence.
Device verification comes off, and that's the honest trade
Device verification says: within a day, one device per employee, and the check-out has to come from the same device as the check-in. One phone punching in six people breaks that on the second person.
So for a proxy punch it's switched off — the same concession a shared kiosk makes, for the same reason. That's a genuine reduction in what's being verified, and it's why the location and network checks matter more here than anywhere else in the product. They're what's left.
If you want the stronger version, card check-in is still the better answer: a physical card per person, at a supervised door, where the credential belongs to the employee rather than to whoever is holding a phone. Proxy check-in is for restaurants that don't have that hardware and aren't going to buy it this quarter.
No reason field
Manual attendance entry asks for a written reason, because backfilling a day that already went past needs a justification someone can read later.
A live punch isn't that. It's a punch, at the current time, for a reason everyone standing there already knows. Demanding free text on a repeated daily action collects "ok" and "." and full stops — noise that looks like an audit trail without being one. What's worth recording is who, and that's captured exactly.
Who gets it
Nobody, until the owner says so. It's a switch on an individual employee's record, next to the check-in exemptions, off for everyone by default — including for owners and managers, who don't inherit it from anything they already hold.
That has one consequence worth stating plainly: an owner who has no employee record in their own workspace can't do this at all, because the flag lives on an employee record and they haven't got one. That's the right trade. Owners already have manual attendance entry, which asks for a written reason and is the better tool for something done at a desk rather than at the door.
Espresso, because it leans on the location and network checks to stay honest, and those are Espresso. Without them this would be a plain buddy-punch button, and we'd have written a different post.