Separate invoice entry, bill approval, payment release and supplier access.
How permissions work
Invoice work
AP Clerk prepares bills and supporting evidence. Approver decides own-scope bills; AP Manager and Controller / CFO act within the configured amount tiers.
Payment work
AP Manager reviews the payment proposal. Controller / CFO releases it. A technical connector or an editable item does not confer release authority.
Bank changes
AP Manager initiates a change and Controller independently confirms it. Retain both identities and protect bank, routing and tax information from operational roles that do not need it.
Supplier access
Vendor User can access only own-supplier bills, documents and permitted payment status. Internal allocations and other vendors remain outside that scope.
Administration
Admin configures roles and integrations. Any exceptional override requires its own explicit authorization and audit evidence; configuration access is not the normal payment signature.
Systems administrator. Owns the configuration surface — Vendors catalog, bill approval matrix, match tolerances, integrations (bank, OCR, fin-accounting, Payroll, scm-procurement) — and the RBAC plumbing. Not the day-to-day AP operator.
Can
Full CRUD on all tables
Configure Vendors catalog and the two-person bank-account verify workflow
Configure match tolerances (per-scope), bill approval matrix (amount tiers + required roles), recurring bills
Manage RBAC and role assignments
Configure inbound feeds (AP-inbox, OCR pipeline, scm-procurement PO + Receipt mirror, pm-subcontractor pay applications) and outbound integrations (fin-accounting JE post, bank NACHA / check / wire, Payroll filing partner for 1099 transmission)
Can't
Release a payment run status: Approved → Funded without an audit-logged break-glass — that’s the Controller’s signature
Controller / CFO
Final signoff on payment runs, top-tier bill approval, year-end 1099 release. Sees every Vendor, every Bill, every Payment in full detail.
Can
Read on all tables
CRUD on Bills (approve top tier per bill approval matrix), payment runs (sign off Status: Approved → Funded — releases the bank file), form1099 tracking (review and flip Status: Computed → ready to file to hand off to Payroll filing partner)
View all vendor bank account / routing number / EIN fields in clear
Confirm Vendor bank-account changes initiated by the AP Manager (the second pair of eyes on the BEC-fraud control)
Reviews and approves
Approve Bills in the highest tier of bill approval matrix (typically >$50k or >$250k depending on configuration)
Can't
Bypass the three-way match — a Bills row in Status: Disputed from a match mismatch routes through the Disputes workflow first, not direct to Approved
Starts on: My Pending Approvals
AP Manager
Owns the AP function end-to-end. Runs the weekly payment cycle, manages Vendor relationships, tracks Disputes through to resolution, owns the year-end 1099 file readiness. The named approver in mid-tier bill bands.
Can
CRUD on Vendors (approve new Vendor onboarding once W-9 is on file; initiate bank-account changes — Controller confirms), vendor contacts, recurring bills, Bills (approve mid-tier per bill approval matrix), bill approval steps (own tier), payment runs (create, edit selections, flip Status: Draft → Approved), payment run items (add / remove / hold), Payments (issue off-cycle one-offs), payment batches, Disputes (assigned-to default), vendor credits, one off payees, form1099 tracking (review and pre-flight before Controller signoff)
View all vendor bank account / routing number / EIN fields
View all payment amount in clear
Can't
Release payment run status: Approved → Funded (Controller signature) and cannot post the GL JE (fin-accounting Controller)
Starts on: My Pending Approvals
AP Clerk
Operational role — the day-to-day Bills processor. Captures / keys / OCRs vendor invoices, runs three-way match, prepares payment run items for AP Manager review.
Can
CRUD on Bills (Status IN Draft, pending match, pending approval), bill lines, bill attachments
Trigger the three-way match action on a Bill (writes three way match results)
CRUD on payment run items (within an AP-Manager-created payment runs in Status: Draft — add Bills, mark Held, set payment method)
Read on Vendors (bank account / routing number / EIN masked), purchase orders, PO line items, goods receipts, receipt line items, bill approval matrix, match tolerances
Open Disputes rows
Can't
Approve own Bill entries beyond the auto-approve tier, cannot initiate Vendor bank-account changes, cannot approve payment runs, cannot release payment runs to bank, cannot configure bill approval matrix or match tolerances
Starts on: Open Disputes
Approver
Line-of-business approver — typically a Department head or Project lead. Approves Bills against own cost-center per the bill approval matrix tier band that maps to the Approver role. Sees own department / project bills only.
Can
Read on Bills and bill lines where bill department or bill project code matches the Approver’s own cost-center assignment
Read on bill approval steps and bill attachments for own-scope bills
CRUD on bill approval steps where assigned to = self (set Decision: Approved / Rejected / Delegated with notes)
Read own-scope Payments (Amount visible) so the Approver sees what was paid against their cost-center
Can't
See other departments’ Bills, cannot edit Bills content, cannot configure bill approval matrix, cannot see any vendor bank account or routing number fields, cannot create Disputes
Starts on: My Pending Approvals
Vendor User
External portal seat — implicit (typically delivered via a vendor-portal sub-app or a shared-link mechanism). Submits invoices via email or portal upload, sees own payment status, updates own remit-to address (subject to AP Manager verify).
Can
CRUD on own bill attachments for attachment type: Vendor invoice PDF (uploads create a new Bills row in Status: Draft via the bill-intake-from-email-or-ocr workflow)
Read on own Bills (Status, amount paid, amount outstanding, due date visible — but not internal GL account / Department / project code tags)
Read on own Payments (Amount, sent at, cleared at, Reference)
Submit remit-to-address change requests (routes to AP Manager)
Can't
See other Vendors, cannot see internal approval state, cannot see other Vendors’ Payments
Read on Vendors (Name + Status only — no EIN, no bank account, no routing number), Bills (header + amount outstanding — line detail aggregated), Payments (aggregated by period only — individual amounts masked), Disputes (Status, Reason, resolution type only)
Read on the eight reports — AP Aging, Top Vendors by Spend, Discount Capture, etc
All access is audit-logged
Can't
See bill approval matrix, match tolerances, form1099 tracking detail (aggregate count only), or any individual approver decisions
Starts on: AP Aging
Set up Accounts Payable Automation your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.
We use essential cookies to run the site and optional cookies for features, analytics, and relevant content.
See Cookie policy
Manage Your Cookie Preferences
We use cookies to enhance your experience, analyze site traffic, and serve relevant content.
By clicking "Accept All," you agree to our use of cookies. You can customize your
preferences at any time.
Your browser's Global Privacy Control signal is honored: advertising cookies are off.
These cookies are required for the website to function properly. They ensure security,
enable basic features like page navigation, and store user session data. You cannot
disable these cookies.
These cookies enable additional features that enhance your experience, such as live chat,
video playback, personalized content recommendations, and remembering user preferences.
These cookies help us understand how visitors interact with our site by collecting
anonymous usage data. This allows us to measure performance, detect issues, and
continuously improve the user experience.
These cookies allow us and advertising partners, including X, to deliver ads tailored to
your interests. They track browsing habits across sites to provide relevant advertising
and measure ad effectiveness.