Roles and permissions

Systems administrator. Owns configuration, integrations, and master data. Not the day-to-day expense submitter or approver.

• Full CRUD on all tables
• Manage ExpenseCategories, ExpensePolicies, PolicyRules, MileageRates, PerDiemRates, CorporateCards master, and the card-program / OCR / Google Maps / Payroll / AP integrations
• Provision Cardholder attribute on Employees on card issuance
• Cannot approve own ExpenseReports
• cannot post a reimbursement without Finance Reviewer sign-off
• cannot override a Block-severity PolicyViolation without an audit-logged break-glass

Oversight role. Reviews high-value reports, audits PolicyViolations trends, signs off CardReconciliations, and owns the relationship with the card program and the reimbursement-channel decision (PayrollAddOn vs SeparateACH).

• CRUD on ExpensePolicies, PolicyRules, CardReconciliations
• Read on all tables
• Approve ExpenseReports above ExpensePolicies.HighValueThreshold (the auto-added Controller step in the approval chain)
• Override or waive Hard PolicyViolations
• cannot waive Block-severity without break-glass
• Sign off CardReconciliations (Status: Balanced → Approved)
• Read-only on CorporateCards.CardLast4 and CardTransactions.RawDescription

The post-manager approver. Checks policy compliance, releases the reimbursement, owns the CardTransactions matching backlog, and is the primary preparer on CardReconciliations.

• CRUD on Reimbursements, CardReconciliations, MealsAndEntertainment
• Update on ExpenseReports (approve / reject / hold at the Finance step), ExpenseLines (adjust ApprovedAmount and Disallowance), ExpenseApprovalSteps, PolicyViolations (mark Justified or Waived for Soft / Hard)
• Update on CardTransactions (set Status: Disputed or Excluded, manually pair to MatchedExpenseLine)
• Read on CorporateCards.CardLast4, CardTransactions.RawDescription, all Receipts including OCR fields
• Cannot approve a Block-severity PolicyViolation, modify ExpenseCategories / ExpensePolicies / PolicyRules (Admin / Controller scope), or post directly to the GL (the gl-post-on-approval workflow does that)

Line manager with scope over direct reports only. The first approver in the chain. Sees aggregate spend for own team but cannot see another team's reports.

• Read on ExpenseReports and ExpenseLines where ExpenseReports.Submitter.Manager = self
• Update on ExpenseReports for own reports' chain step (approve / reject / hold at the Manager step)
• Read on Receipts and PolicyViolations for those same lines
• Cannot see another manager's team's reports, cannot see CorporateCards, CardTransactions.RawDescription, or Reimbursements.Amount of reports
• Cannot waive Hard or Block PolicyViolations (routes to Finance Reviewer)
• Cannot modify ApprovedAmount — the Manager step is approve-as-submitted or reject
• line-level disallowances are the Finance Reviewer's authority

Self-service submitter. Files own ExpenseReports, uploads Receipts, captures Mileage, registers own Vehicles. Reads own reimbursement status. Cannot see anyone else's data.

• CRUD on own ExpenseReports, ExpenseLines, Receipts, MileageEntries, Vehicles, MealsAndEntertainment (when authoring own M&E lines) while ExpenseReports.Status IN (Draft, Held, Rejected)
• Read on own Reimbursements (Amount, Status, ScheduledFor, PaidAt)
• Read on ExpenseCategories, ExpensePolicies, PolicyRules, MileageRates, PerDiemRates (the published rule set the submitter must comply with)
• Cannot edit a Submitted report without recall (recall flips Status back to Draft and voids the prior approval steps)
• Cannot approve own report
• Cannot see other employees' reports, receipts, mileage, or reimbursements

A Permissions attribute on Employee — set true when the Employee has at least one CorporateCards.Cardholder = self row in Status: Active. Inherits all Employee permissions plus card-specific surfaces.

• Read on own CorporateCards (CardLast4 visible to self, masked to non-self Employees)
• Read on own CardTransactions (RawDescription visible to self)
• Update on own CardTransactions to advance Status: Unmatched → Matched by linking to a self-authored ExpenseLines.PaymentMethod = CorporateCard row, or to flag Status: Disputed with a dispute reason
• Required to justify (attach Receipt + Category + Description) every CardTransaction within ExpensePolicies.JustificationWindowDays (default 30)
• Cannot see another Cardholder's transactions or cards

Read-only seat for periodic audit sampling — internal Audit team, external auditor, or controls reviewer. Full visibility across the expense surface; access is audit-logged at the row level.

• Read on all tables including CorporateCards.CardLast4, CardTransactions.RawDescription, Receipts (including OCR fields), PolicyViolations, ExpenseApprovalSteps, Reimbursements, and CardReconciliations
• Cannot create, update, or delete any row
• Can export reports
• All Audit reads write a row to the access log