Systems administrator. Owns configuration, integrations, and master data. Not the day-to-day expense submitter or approver.
Can
Full CRUD on all tables
Manage expense categories, expense policies, policy rules, mileage rates, per diem rates, corporate cards master, and the card-program / OCR / Google Maps / Payroll / AP integrations
Provision Cardholder attribute on Employees on card issuance
Can't
Approve own expense reports
Post a reimbursement without Finance Reviewer sign-off
Override a Block-severity policy violation without an audit-logged break-glass
Controller / CFO
Oversight role. Reviews high-value reports, audits policy violations trends, signs off card reconciliations, and owns the relationship with the card program and the reimbursement-channel decision (payroll add on vs separate ACH).
Can
CRUD on expense policies, policy rules, card reconciliations
Read on all tables
Override or waive Hard policy violations
Read-only on corporate card card last4 and card transaction raw description
Reviews and approves
Approve expense reports above expense policy high value threshold (the auto-added Controller step in the approval chain)
Sign off card reconciliations (Status: Balanced → Approved)
Can't
Waive Block-severity without break-glass
Starts on: Reports Awaiting Finance
Finance Reviewer
The post-manager approver. Checks policy compliance, releases the reimbursement, owns the card transactions matching backlog, and is the primary preparer on card reconciliations.
Can
CRUD on Reimbursements, card reconciliations, meals and entertainment
Update on expense reports (approve / reject / hold at the Finance step), expense lines (adjust approved amount and Disallowance), expense approval steps, policy violations (mark Justified or Waived for Soft / Hard)
Update on card transactions (set Status: Disputed or Excluded, manually pair to matched expense line)
Read on corporate card card last4, card transaction raw description, all Receipts including OCR fields
Can't
Approve a Block-severity policy violation, modify expense categories / expense policies / policy rules (Admin / Controller scope), or post directly to the GL (the gl-post-on-approval workflow does that)
Starts on: Reports Awaiting Finance
Manager
Line manager with scope over direct reports only. The first approver in the chain. Sees aggregate spend for own team but cannot see another team’s reports.
Can
Read on expense reports and expense lines where expense report submitter.Manager = self
Update on expense reports for own reports’ chain step (approve / reject / hold at the Manager step)
Read on Receipts and policy violations for those same lines
line-level disallowances are the Finance Reviewer’s authority
Can't
See another manager’s team’s reports, cannot see corporate cards, card transaction raw description, or reimbursement amount of reports
Waive Hard or Block policy violations (routes to Finance Reviewer)
Modify approved amount — the Manager step is approve-as-submitted or reject
Starts on: Reports Awaiting My Approval
Employee
Self-service submitter. Files own expense reports, uploads Receipts, captures Mileage, registers own Vehicles. Reads own reimbursement status. Cannot see anyone else’s data.
Can
CRUD on own expense reports, expense lines, Receipts, mileage entries, Vehicles, meals and entertainment (when authoring own M&E lines) while expense report status IN (Draft, Held, Rejected)
Read on own Reimbursements (Amount, Status, scheduled for, paid at)
Read on expense categories, expense policies, policy rules, mileage rates, per diem rates (the published rule set the submitter must comply with)
Can't
Edit a Submitted report without recall (recall flips Status back to Draft and voids the prior approval steps)
Approve own report
See other employees’ reports, receipts, mileage, or reimbursements
Starts on: My Drafts
Cardholder
A Permissions attribute on Employee — set true when the Employee has at least one corporate card cardholder = self row in Status: Active. Inherits all Employee permissions plus card-specific surfaces.
Can
Read on own corporate cards (card last4 visible to self, masked to non-self Employees)
Read on own card transactions (raw description visible to self)
Update on own card transactions to advance Status: Unmatched → Matched by linking to a self-authored expense line payment method = corporate card row, or to flag Status: Disputed with a dispute reason
Required to justify (attach Receipt + Category + Description) every card transaction within expense policy justification window days (default 30)
Can't
See another Cardholder’s transactions or cards
Starts on: My Drafts
Audit
Read-only seat for periodic audit sampling — internal Audit team, external auditor, or controls reviewer. Full visibility across the expense surface; access is audit-logged at the row level.
Can
Read on all tables including corporate card card last4, card transaction raw description, Receipts (including OCR fields), policy violations, expense approval steps, Reimbursements, and card reconciliations
Can export reports
All Audit reads write a row to the access log
Can't
Create, update, or delete any row
Starts on: High-Value Reports
Set up Expense Reporting System your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.
We use essential cookies to run the site and optional cookies for features, analytics, and relevant content.
See Cookie policy
Manage Your Cookie Preferences
We use cookies to enhance your experience, analyze site traffic, and serve relevant content.
By clicking "Accept All," you agree to our use of cookies. You can customize your
preferences at any time.
Your browser's Global Privacy Control signal is honored: advertising cookies are off.
These cookies are required for the website to function properly. They ensure security,
enable basic features like page navigation, and store user session data. You cannot
disable these cookies.
These cookies enable additional features that enhance your experience, such as live chat,
video playback, personalized content recommendations, and remembering user preferences.
These cookies help us understand how visitors interact with our site by collecting
anonymous usage data. This allows us to measure performance, detect issues, and
continuously improve the user experience.
These cookies allow us and advertising partners, including X, to deliver ads tailored to
your interests. They track browsing habits across sites to provide relevant advertising
and measure ad effectiveness.