Roles and permissions

Give people the access their work requires.

Permissions

Summarised from the authored role permissions. Scope restrictions such as “own records” still apply; these symbols do not indicate completeness or runtime access.

TableOwnerBookkeeperSales RepHR / PayrollEmployee
master
ContactsNo table-specific permission stated Manage / maintain: Manage Contacts, Products, ChartOfAccounts and TaxRates under approved setup Specific actions: Create Contacts assigned to self; View assigned Contacts and issued InvoicesNo table-specific permission statedNo table-specific permission stated
ProductsNo table-specific permission stated Manage / maintain: Manage Contacts, Products, ChartOfAccounts and TaxRates under approved setup View: View ProductsNo table-specific permission statedNo table-specific permission stated
EmployeesNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated Manage / maintain: Manage Employees, draft PayrollRuns, PayStatements and PayStatementLines View: View own Employees record with protected configuration fields hidden
TaxRatesNo table-specific permission stated Manage / maintain: Manage Contacts, Products, ChartOfAccounts and TaxRates under approved setupNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
CompanySettings Manage / maintain: Manage approved CompanySettings and role grantsNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
LeaveBalancesNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated Manage / maintain: Manage LeaveBalances with retained adjustment history View: View own LeaveBalances
transaction
Bills Specific actions: Approve assigned Invoices, above-threshold Bills, PaymentsMade, manual JournalEntries, PayrollRuns and AccountingPeriods Manage / maintain: Manage draft Invoices, InvoiceItems, Bills, BillItems, PaymentsReceived, PaymentAllocations, PaymentsMade, JournalEntries, JournalEntryLines and BankStatementLinesNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
LeadsNo table-specific permission statedNo table-specific permission stated Manage / maintain: Manage own Leads, Opportunities and ActivitiesNo table-specific permission statedNo table-specific permission stated
OpportunitiesNo table-specific permission statedNo table-specific permission stated Manage / maintain: Manage own Leads, Opportunities and ActivitiesNo table-specific permission statedNo table-specific permission stated
ActivitiesNo table-specific permission statedNo table-specific permission stated Manage / maintain: Manage own Leads, Opportunities and ActivitiesNo table-specific permission statedNo table-specific permission stated
PayrollRuns Specific actions: Approve assigned Invoices, above-threshold Bills, PaymentsMade, manual JournalEntries, PayrollRuns and AccountingPeriodsNo table-specific permission statedNo table-specific permission stated Manage / maintain: Manage Employees, draft PayrollRuns, PayStatements and PayStatementLinesNo table-specific permission stated
PayStatementsNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated Manage / maintain: Manage Employees, draft PayrollRuns, PayStatements and PayStatementLines View: View own published PayStatements and PayStatementLines
LeaveRequests Specific actions: Approve LeaveRequests and ExpenseClaims as independent substituteNo table-specific permission statedNo table-specific permission stated Specific actions: Approve assigned LeaveRequests and ExpenseClaims except own claims Specific actions: Create and edit own submitted LeaveRequests and ExpenseClaims before decision
ExpenseClaims Specific actions: Approve LeaveRequests and ExpenseClaims as independent substitute View: View approved ExpenseClaims for settlementNo table-specific permission stated Specific actions: Approve assigned LeaveRequests and ExpenseClaims except own claims Specific actions: Create and edit own submitted LeaveRequests and ExpenseClaims before decision
BankStatementLinesNo table-specific permission stated Manage / maintain: Manage draft Invoices, InvoiceItems, Bills, BillItems, PaymentsReceived, PaymentAllocations, PaymentsMade, JournalEntries, JournalEntryLines and BankStatementLinesNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
line item
BillItemsNo table-specific permission stated Manage / maintain: Manage draft Invoices, InvoiceItems, Bills, BillItems, PaymentsReceived, PaymentAllocations, PaymentsMade, JournalEntries, JournalEntryLines and BankStatementLinesNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
PayStatementLinesNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated Manage / maintain: Manage Employees, draft PayrollRuns, PayStatements and PayStatementLines View: View own published PayStatements and PayStatementLines
finance
ChartOfAccountsNo table-specific permission stated Manage / maintain: Manage Contacts, Products, ChartOfAccounts and TaxRates under approved setupNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
Invoices Specific actions: Approve assigned Invoices, above-threshold Bills, PaymentsMade, manual JournalEntries, PayrollRuns and AccountingPeriods Manage / maintain: Manage draft Invoices, InvoiceItems, Bills, BillItems, PaymentsReceived, PaymentAllocations, PaymentsMade, JournalEntries, JournalEntryLines and BankStatementLines View: View assigned Contacts and issued InvoicesNo table-specific permission statedNo table-specific permission stated
InvoiceItemsNo table-specific permission stated Manage / maintain: Manage draft Invoices, InvoiceItems, Bills, BillItems, PaymentsReceived, PaymentAllocations, PaymentsMade, JournalEntries, JournalEntryLines and BankStatementLinesNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
PaymentsReceivedNo table-specific permission stated Manage / maintain: Manage draft Invoices, InvoiceItems, Bills, BillItems, PaymentsReceived, PaymentAllocations, PaymentsMade, JournalEntries, JournalEntryLines and BankStatementLinesNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
PaymentsMade Specific actions: Approve assigned Invoices, above-threshold Bills, PaymentsMade, manual JournalEntries, PayrollRuns and AccountingPeriods Manage / maintain: Manage draft Invoices, InvoiceItems, Bills, BillItems, PaymentsReceived, PaymentAllocations, PaymentsMade, JournalEntries, JournalEntryLines and BankStatementLinesNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
JournalEntries Specific actions: Approve assigned Invoices, above-threshold Bills, PaymentsMade, manual JournalEntries, PayrollRuns and AccountingPeriods Manage / maintain: Manage draft Invoices, InvoiceItems, Bills, BillItems, PaymentsReceived, PaymentAllocations, PaymentsMade, JournalEntries, JournalEntryLines and BankStatementLinesNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
JournalEntryLinesNo table-specific permission stated Manage / maintain: Manage draft Invoices, InvoiceItems, Bills, BillItems, PaymentsReceived, PaymentAllocations, PaymentsMade, JournalEntries, JournalEntryLines and BankStatementLinesNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
AccountingPeriods Specific actions: Approve assigned Invoices, above-threshold Bills, PaymentsMade, manual JournalEntries, PayrollRuns and AccountingPeriodsNo table-specific permission statedNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
PaymentAllocationsNo table-specific permission stated Manage / maintain: Manage draft Invoices, InvoiceItems, Bills, BillItems, PaymentsReceived, PaymentAllocations, PaymentsMade, JournalEntries, JournalEntryLines and BankStatementLinesNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated
PayrollPaymentsNo table-specific permission statedNo table-specific permission statedNo table-specific permission stated View: View PayrollPayments outcomesNo table-specific permission stated
  • OwnerView business reports and permitted employee compensationCannot alter posted journals or self-approve
  • BookkeeperCannot read employee salary, individual payslips or approve own financial work
  • HR / PayrollCannot approve own payroll preparation or release unrestricted vendor payments
  • EmployeeCannot edit approved records or read other employees
Manage / maintain View Specific actions— No table-specific permission statedPermissions also apply to agents

How permissions work

6 rules

Bind each authenticated identity to its Employees record; never accept a client-selected employee as proof of identity.

Sales access follows assigned leads, opportunities and customers. Payroll detail and the books remain separate.

Employees read their own published statements and explicit leave balances. Protect file links and exports with the same scope.

Independent decisions require distinct preparer and approver identities, including Owner preparations and employee claims.

Bookkeeper can use aggregate payroll journals without reading BaseSalary or individual statements.

Admin configures approved access and integrations; administration alone does not authorize business decisions or changing posted history.

The roles

Owner

Own business decisions and company settings within the single-entity workspace. Independent approval requires a different authenticated person from the preparer or claimant.

Permissions and screens
  • View business reports and permitted employee compensation
  • Approve assigned Invoices, above-threshold Bills, PaymentsMade, manual JournalEntries, PayrollRuns and AccountingPeriods
  • Approve LeaveRequests and ExpenseClaims as independent substitute
  • Manage approved CompanySettings and role grants
  • Cannot alter posted journals or self-approve
Payroll Calendar
Run NumberPrepared ByPeriod StartPeriod End
My PipelineProspecting
Opportunity NumberNameCustomerStage
Proposal
Invoices Awaiting ApprovalPendingApproval
Invoice NumberCustomerInvoice DateTotal Amount
Bookkeeper

Prepare invoices, bills, payment allocations, journals and bank reconciliation. Payroll access is aggregate journal totals only.

Permissions and screens
  • Manage draft Invoices, InvoiceItems, Bills, BillItems, PaymentsReceived, PaymentAllocations, PaymentsMade, JournalEntries, JournalEntryLines and BankStatementLines
  • Manage Contacts, Products, ChartOfAccounts and TaxRates under approved setup
  • Prepare AccountingPeriods
  • View approved ExpenseClaims for settlement
  • Cannot read employee salary, individual payslips or approve own financial work
Bank Matching QueueUnmatched
Statement Line NumberBank AccountStatement DateAmount
Outstanding ExpensesSubmitted
Claim NumberEmployeeClaim DateCategory
Meals
Confirmed Customer ReceiptsConfirmed
Payment NumberCustomerPayment DateAmount
Sales Rep

Work own assigned leads, opportunities and activities; read assigned customer invoices without finance or payroll access.

Permissions and screens
  • Manage own Leads, Opportunities and Activities
  • Create Contacts assigned to self
  • View assigned Contacts and issued Invoices
  • View Products
  • Cannot issue invoices, read Bills, payroll or general-ledger details
My PipelineProspecting
Opportunity NumberNameCustomerStage
Proposal
My LeadsNew
Lead NumberNameCompanySource
Referral
My Follow-upsOpen
Activity NumberSubjectRelated OpportunityDue Date
HR / Payroll

Maintain employee records and prepare payroll. Independently decide assigned leave and expenses within the approved policy.

Permissions and screens
  • Manage Employees, draft PayrollRuns, PayStatements and PayStatementLines
  • Manage LeaveBalances with retained adjustment history
  • Approve assigned LeaveRequests and ExpenseClaims except own claims
  • View PayrollPayments outcomes
  • Cannot approve own payroll preparation or release unrestricted vendor payments
Payroll Calendar
Run NumberPrepared ByPeriod StartPeriod End
Leave Awaiting ReviewSubmitted
Request NumberEmployeeLeave TypeStart Date
Sick
Outstanding ExpensesSubmitted
Claim NumberEmployeeClaim DateCategory
Meals
Employee

Use own published payslips, leave requests and expense claims. Private documents remain scoped to the authenticated employee.

Permissions and screens
  • View own Employees record with protected configuration fields hidden
  • View own published PayStatements and PayStatementLines
  • View own LeaveBalances
  • Create and edit own submitted LeaveRequests and ExpenseClaims before decision
  • Cannot edit approved records or read other employees
My Payslips
Statement NumberPeriod EndNet PayPayment Method
Check
My Leave Balances
Balance NumberLeave TypeEntitlementReserved
Sick
ERP•AI workspace

Start now ERP for Small Business

Create your ERP.AI account and get started with Proto.

Start now Download agent

Customize ERP for Small Business. With Proto, your desktop AI agent.

Ask Proto to help you customize ERP for Small Business.

Customize
ERP for Small Business. Ask: “Adapt Invoicing.” ProtoYour desktop AI agent
Download nowFree install · ~1 GB · AI usage extra