Expenses access and operation permissions
Expenses endpoints are classified under the ACCOUNTING module in the current endpoint policies. There is no separate EXPENSE module to enable in this implementation. Permissions, lookup capabilities and business-unit access remain separate requirements.
Permission reference
| Task | Authority |
|---|---|
| Register/detail | expense.view |
| Add / edit / delete draft | expense.create / expense.update / expense.delete |
| Guided expense status action | expense.status.update |
| Decide pending manager tier | expense.manager-approve |
| Decide pending director tier | expense.director-approve |
| Reject pending decision | expense.reject |
| Read linked journal | expense.journal.view plus expense view |
| Confirm / reset linked journal | expense.journal.post / expense.journal.reset |
| Read related payments | expense.payment.view plus expense view |
| Record reimbursement | expense.payment.create |
| Confirm or validate payment | expense.payment.post |
| Reset / cancel payment | expense.payment.reset / expense.payment.cancel |
View authority does not grant mutation rights. Posting does not imply reset/cancel. A manager's name in the Manager field or a role name containing MANAGER does not replace the actual decision permission.
Lookup and unit checks
User lookups use Administration APIs; account choices use Accounting; vendor search needs SUPPLIER and supplier.view. The browser filters new vendor choices to active suppliers. A user may have expense creation rights yet lack a required lookup, so approve complete task access rather than one isolated permission.
Expense searches and normal detail reads use allowed business units. The owning unit is captured from the selected User's access on creation, not chosen directly on the form. Financial paths also depend on the underlying Accounting/Payment services and their checks.
Current boundaries
The source does not implement a generic independent-submitter/approver rule or enforce that the selected Manager personally performs the decision. Use the organisation's approved separation of duties; do not label it as a built-in four-eyes guarantee.
Some payment/journal lifecycle wrappers resolve the expense relationship and delegate unit validation to the underlying financial record. Because the reimbursement dialog currently supplies a fixed unit ID, do not assume every related record automatically inherits identical expense-unit scope. See Known limits.
Use Administration for role/unit changes. A missing button can be expected permission or state gating. Reopening a URL is not an access bypass, and no tenant administrator role name grants implicit authority to all operations.