--- id: AUTH-ACC title: Accounting Authorization Model product_area: accounting revision: 1 status: draft design_intent: proposed implementation_evidence: observed source_sha: rhythm-v2-docs: 9e2588944e73c798a1e4f71dc5802ed24b114e36 services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f scopes: - name: workspace meaning: Customer grants authorize Accounting work in the selected workspace. provenance: observed source: >- services-accounting:modules/products/aws/api/products.routes.ts:begin; rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-010-give-and-take-away-roles-at-the-right-scope.md - name: business unit meaning: >- A financial ownership and reference-validation boundary inside a workspace; close and reconciliation grants are workspace-wide in the examined release. provenance: documented source: >- rhythm-v2-docs:specs/accounting/close/design/decisions/ADR-ACC-CLS-012-close-and-reopen-grants-are-workspace-wide.md; specs/accounting/reconciliation/design/decisions/ADR-ACC-REC-015-permissions-are-workspace-wide-in-the-first-release.md - name: record meaning: >- Ownership, version, locks and lifecycle eligibility further restrict the selected financial record; a record identifier supplies no authority by itself. provenance: observed source: >- services-accounting:modules/products/aws/api/products.routes.ts; modules/transactions/aws/api/payments.routes.ts - name: platform staff and machine meaning: >- Staff-only system routes and registered service calls have separate authority from customer roles. provenance: observed source: >- services-accounting:aws/accounting.service.ts:PaymentsPermissions; rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md roles: - id: ROLE-ACC-001 name: Read Only who: A customer role composed with the generated Accounting read policy. grants: - accounting.accounting-projects.read - accounting.application.access - accounting.ar-aging.read - accounting.ar-snapshot-items.query - accounting.ar-snapshot-totals.query - accounting.bank-accounts.read - accounting.batch-assignment-settings.read - accounting.batch-postings.preview - accounting.batches.query - accounting.batches.read - accounting.business-units.query - accounting.business-units.read - accounting.credit-applications.query - accounting.credit-applications.read - accounting.credit-memos.query - accounting.credit-memos.read - accounting.credits.query - accounting.credits.read - accounting.customer-terms.read - accounting.debit-memos.query - accounting.debit-memos.read - accounting.departments.read - accounting.disputes.read - accounting.document-templates.read - accounting.exchange-rates.read - accounting.expected-remittances.query - accounting.fiscal-periods.read - accounting.fiscal-years.read - accounting.gl-accounts.read - accounting.invoices.query - accounting.invoices.read - accounting.merchant-accounts.read - accounting.payment-element.read - accounting.payment-methods.read - accounting.payment-terms.read - accounting.payments.query - accounting.payments.read - accounting.payouts.read - accounting.product-accounting.read - accounting.products.read - accounting.reconciliation-batches.read - accounting.reconciliation-exceptions.read - accounting.recurring-batches.read - accounting.recurring-billing-runs.read - accounting.refunds.query - accounting.refunds.read - accounting.remittances.read - accounting.revenue-schedule-entries.query - accounting.reversals.preview - accounting.reversals.read - accounting.settings.read - accounting.settlement-items.read - accounting.settlements.read - accounting.stripe-settings.read - accounting.subledger-entries.read - accounting.subledger-entry-lines.query - accounting.tax-classes.read - accounting.tax-zones.read - accounting.tax.calculate - accounting.transactions.query - accounting.write-offs.query - accounting.write-offs.read provenance: observed source: >- services-accounting:aws/accounting.service.ts#Built-in policies; rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md - id: ROLE-ACC-002 name: User who: A customer role composed with the generated Accounting user policy. grants: - accounting.accounting-projects.read - accounting.application.access - accounting.ar-aging.read - accounting.ar-snapshot-items.query - accounting.ar-snapshot-totals.query - accounting.bank-accounts.read - accounting.batch-assignment-settings.read - accounting.batch-postings.post - accounting.batch-postings.preview - accounting.batches.create - accounting.batches.delete - accounting.batches.query - accounting.batches.read - accounting.batches.update - accounting.business-units.query - accounting.business-units.read - accounting.credit-applications.create - accounting.credit-applications.query - accounting.credit-applications.read - accounting.credit-applications.update - accounting.credit-memos.create - accounting.credit-memos.query - accounting.credit-memos.read - accounting.credit-memos.update - accounting.credits.create - accounting.credits.query - accounting.credits.read - accounting.credits.update - accounting.customer-terms.manage - accounting.customer-terms.read - accounting.debit-memos.create - accounting.debit-memos.query - accounting.debit-memos.read - accounting.debit-memos.update - accounting.departments.read - accounting.disputes.create - accounting.disputes.read - accounting.disputes.update - accounting.document-templates.read - accounting.exchange-rates.read - accounting.expected-remittances.query - accounting.fiscal-periods.read - accounting.fiscal-years.read - accounting.gl-accounts.read - accounting.invoices.adjust - accounting.invoices.create - accounting.invoices.delete - accounting.invoices.email - accounting.invoices.query - accounting.invoices.read - accounting.invoices.update - accounting.invoices.void - accounting.merchant-accounts.read - accounting.payment-element.create - accounting.payment-element.read - accounting.payment-methods.read - accounting.payment-terms.read - accounting.payments.create - accounting.payments.query - accounting.payments.read - accounting.payments.reverse - accounting.payments.update - accounting.payments.void - accounting.payouts.create - accounting.payouts.delete - accounting.payouts.read - accounting.payouts.update - accounting.payouts.verify - accounting.product-accounting.read - accounting.products.read - accounting.reconciliation-batches.create - accounting.reconciliation-batches.delete - accounting.reconciliation-batches.read - accounting.reconciliation-batches.update - accounting.reconciliation-exceptions.read - accounting.reconciliation-exceptions.update - accounting.recurring-batches.read - accounting.recurring-billing-runs.read - accounting.refunds.approve - accounting.refunds.create - accounting.refunds.execute - accounting.refunds.query - accounting.refunds.read - accounting.remittances.create - accounting.remittances.read - accounting.remittances.void - accounting.revenue-schedule-entries.query - accounting.reversals.create - accounting.reversals.preview - accounting.reversals.read - accounting.settings.read - accounting.settlement-items.read - accounting.settlements.create - accounting.settlements.read - accounting.stripe-settings.read - accounting.subledger-entries.read - accounting.subledger-entry-lines.query - accounting.tax-classes.read - accounting.tax-zones.read - accounting.tax.calculate - accounting.transactions.query - accounting.write-offs.create - accounting.write-offs.query - accounting.write-offs.read - accounting.write-offs.update provenance: observed source: >- services-accounting:aws/accounting.service.ts#Built-in policies; rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md - id: ROLE-ACC-003 name: Administrator who: >- A customer role composed with the generated Accounting administrator policy. grants: - accounting.accounting-projects.bulk - accounting.accounting-projects.create - accounting.accounting-projects.delete - accounting.accounting-projects.read - accounting.accounting-projects.update - accounting.application.access - accounting.ar-aging.read - accounting.ar-snapshot-items.query - accounting.ar-snapshot-totals.query - accounting.bank-accounts.bulk - accounting.bank-accounts.create - accounting.bank-accounts.delete - accounting.bank-accounts.read - accounting.bank-accounts.update - accounting.batch-assignment-settings.delete - accounting.batch-assignment-settings.read - accounting.batch-assignment-settings.update - accounting.batch-postings.post - accounting.batch-postings.preview - accounting.batch-postings.unpost - accounting.batches.create - accounting.batches.delete - accounting.batches.query - accounting.batches.read - accounting.batches.update - accounting.business-units.bulk - accounting.business-units.create - accounting.business-units.delete - accounting.business-units.query - accounting.business-units.read - accounting.business-units.update - accounting.credit-applications.create - accounting.credit-applications.query - accounting.credit-applications.read - accounting.credit-applications.update - accounting.credit-memos.create - accounting.credit-memos.query - accounting.credit-memos.read - accounting.credit-memos.update - accounting.credits.create - accounting.credits.query - accounting.credits.read - accounting.credits.update - accounting.customer-terms.manage - accounting.customer-terms.read - accounting.debit-memos.create - accounting.debit-memos.query - accounting.debit-memos.read - accounting.debit-memos.update - accounting.departments.bulk - accounting.departments.create - accounting.departments.delete - accounting.departments.read - accounting.departments.update - accounting.disputes.create - accounting.disputes.read - accounting.disputes.update - accounting.document-templates.bulk - accounting.document-templates.create - accounting.document-templates.delete - accounting.document-templates.read - accounting.document-templates.update - accounting.exchange-rates.bulk - accounting.exchange-rates.create - accounting.exchange-rates.delete - accounting.exchange-rates.read - accounting.exchange-rates.update - accounting.expected-remittances.query - accounting.fiscal-periods.close - accounting.fiscal-periods.read - accounting.fiscal-periods.reopen - accounting.fiscal-years.bulk - accounting.fiscal-years.create - accounting.fiscal-years.delete - accounting.fiscal-years.read - accounting.fiscal-years.update - accounting.gl-accounts.bulk - accounting.gl-accounts.create - accounting.gl-accounts.delete - accounting.gl-accounts.read - accounting.gl-accounts.update - accounting.invoices.adjust - accounting.invoices.create - accounting.invoices.delete - accounting.invoices.email - accounting.invoices.query - accounting.invoices.read - accounting.invoices.update - accounting.invoices.void - accounting.merchant-accounts.bulk - accounting.merchant-accounts.create - accounting.merchant-accounts.delete - accounting.merchant-accounts.read - accounting.merchant-accounts.update - accounting.payment-element.create - accounting.payment-element.read - accounting.payment-methods.bulk - accounting.payment-methods.create - accounting.payment-methods.delete - accounting.payment-methods.read - accounting.payment-methods.update - accounting.payment-terms.bulk - accounting.payment-terms.create - accounting.payment-terms.delete - accounting.payment-terms.read - accounting.payment-terms.update - accounting.payments.create - accounting.payments.query - accounting.payments.read - accounting.payments.reverse - accounting.payments.update - accounting.payments.void - accounting.payouts.create - accounting.payouts.delete - accounting.payouts.read - accounting.payouts.update - accounting.payouts.verify - accounting.product-accounting.delete - accounting.product-accounting.read - accounting.product-accounting.update - accounting.products.create - accounting.products.delete - accounting.products.read - accounting.products.update - accounting.reconciliation-batches.create - accounting.reconciliation-batches.delete - accounting.reconciliation-batches.finalize - accounting.reconciliation-batches.read - accounting.reconciliation-batches.reverse - accounting.reconciliation-batches.update - accounting.reconciliation-exceptions.accept - accounting.reconciliation-exceptions.read - accounting.reconciliation-exceptions.update - accounting.recurring-batches.create - accounting.recurring-batches.delete - accounting.recurring-batches.read - accounting.recurring-batches.update - accounting.recurring-billing-runs.read - accounting.refunds.approve - accounting.refunds.create - accounting.refunds.execute - accounting.refunds.query - accounting.refunds.read - accounting.remittances.create - accounting.remittances.read - accounting.remittances.void - accounting.revenue-schedule-entries.query - accounting.reversals.create - accounting.reversals.preview - accounting.reversals.read - accounting.settings.bulk - accounting.settings.create - accounting.settings.delete - accounting.settings.read - accounting.settings.update - accounting.settlement-items.read - accounting.settlement-items.resolve - accounting.settlements.create - accounting.settlements.read - accounting.stripe-settings.read - accounting.stripe-settings.update - accounting.subledger-entries.read - accounting.subledger-entry-lines.query - accounting.tax-classes.bulk - accounting.tax-classes.create - accounting.tax-classes.delete - accounting.tax-classes.read - accounting.tax-classes.update - accounting.tax-zones.bulk - accounting.tax-zones.create - accounting.tax-zones.delete - accounting.tax-zones.read - accounting.tax-zones.update - accounting.tax.calculate - accounting.transactions.query - accounting.write-offs.create - accounting.write-offs.query - accounting.write-offs.read - accounting.write-offs.update provenance: observed source: >- services-accounting:aws/accounting.service.ts#Built-in policies; rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md - id: ROLE-ACC-004 name: Reconciliation Preparer who: A customer role composed with the named reconciliation preparation policy. grants: - accounting.application.access - accounting.payouts.read - accounting.payouts.create - accounting.payouts.update - accounting.payouts.delete - accounting.payouts.verify - accounting.reconciliation-batches.read - accounting.reconciliation-batches.create - accounting.reconciliation-batches.update - accounting.reconciliation-batches.delete - accounting.settlement-items.read - accounting.reconciliation-exceptions.read - accounting.reconciliation-exceptions.update provenance: observed source: >- services-accounting:aws/accounting.service.ts:ReconciliationBuiltInPolicies - id: ROLE-ACC-005 name: Reconciliation Approver who: A customer role composed with the named reconciliation approval policy. grants: - accounting.application.access - accounting.payouts.read - accounting.payouts.create - accounting.payouts.update - accounting.payouts.delete - accounting.payouts.verify - accounting.reconciliation-batches.read - accounting.reconciliation-batches.create - accounting.reconciliation-batches.update - accounting.reconciliation-batches.delete - accounting.settlement-items.read - accounting.reconciliation-exceptions.read - accounting.reconciliation-exceptions.update - accounting.reconciliation-batches.finalize - accounting.reconciliation-batches.reverse - accounting.settlement-items.resolve - accounting.reconciliation-exceptions.accept provenance: observed source: >- services-accounting:aws/accounting.service.ts:ReconciliationBuiltInPolicies permissions: - key: accounting.accounting-projects.bulk intent: Perform bulk administration of accounting projects. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:AccountingProjectsPermissions - key: accounting.accounting-projects.create intent: Create accounting projects. operations: - createAccountingProject surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:AccountingProjectsPermissions - key: accounting.accounting-projects.delete intent: Remove accounting projects. operations: - deleteAccountingProject surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:AccountingProjectsPermissions - key: accounting.accounting-projects.read intent: Read accounting projects. operations: - listAccountingProjects - getAccountingProject surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:AccountingProjectsPermissions - key: accounting.accounting-projects.update intent: Change accounting projects. operations: - updateAccountingProject surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:AccountingProjectsPermissions - key: accounting.application.access intent: Open the Accounting application. operations: - listCurrencies - listDefaultGlAccountPurposes - listPaymentProcessors - previewSchedule - listScheduleRuns surfaces: - api - console - job guarded_by: - BR-CAP-ACC-BKS-016-04 - BR-CAP-ACC-REC-004-08 - BR-CAP-ACC-REC-020-07 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ApplicationPermissions' - key: accounting.ar-aging.read intent: Read receivables aging. operations: - getArAging surfaces: - api - console - job guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ArAgingPermissionSet' - key: accounting.ar-snapshot-items.query intent: Query ar snapshot items. operations: [] surfaces: - Platform query - api - console - job guarded_by: [] tier: read staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:ArSnapshotItemsDatasetPermissions - key: accounting.ar-snapshot-totals.query intent: Query ar snapshot totals. operations: [] surfaces: - Platform query - api - console - job guarded_by: [] tier: read staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:ArSnapshotTotalsDatasetPermissions - key: accounting.bank-accounts.bulk intent: Perform bulk administration of bank accounts. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BankAccountsPermissions' - key: accounting.bank-accounts.create intent: Create bank accounts. operations: - createBankAccount surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BankAccountsPermissions' - key: accounting.bank-accounts.delete intent: Remove bank accounts. operations: - deleteBankAccount surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BankAccountsPermissions' - key: accounting.bank-accounts.read intent: Read bank accounts. operations: - listBankAccounts - getBankAccount surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BankAccountsPermissions' - key: accounting.bank-accounts.update intent: Change bank accounts. operations: - updateBankAccount surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BankAccountsPermissions' - key: accounting.batch-assignment-settings.delete intent: Remove batch assignment settings. operations: - deleteBatchAssignmentSettings surfaces: - api - console guarded_by: - BR-CAP-ACC-BAT-011-03 tier: admin staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:BatchAssignmentSettingsPermissions - key: accounting.batch-assignment-settings.read intent: Read batch assignment settings. operations: - getBatchAssignmentSettings - evaluateBatchAssignment surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:BatchAssignmentSettingsPermissions - key: accounting.batch-assignment-settings.update intent: Change batch assignment settings. operations: - saveBatchAssignmentSettings surfaces: - api - console guarded_by: - BR-CAP-ACC-BAT-011-03 tier: admin staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:BatchAssignmentSettingsPermissions - key: accounting.batch-postings.post intent: Post batch posting work. operations: - listBatchActions - performBatchAction - postBatches surfaces: - api - console - job guarded_by: - BR-CAP-ACC-BAT-004-01 - BR-CAP-ACC-BAT-004-08 - BR-CAP-ACC-BAT-013-05 - BR-CAP-ACC-BAT-013-07 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BatchPostingsPermissions' - key: accounting.batch-postings.preview intent: Preview batch posting work. operations: - previewBatchPostings surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BatchPostingsPermissions' - key: accounting.batch-postings.unpost intent: Unpost batch posting work. operations: - listBatchActions - performBatchAction - unpostBatches surfaces: - api - console - job guarded_by: - BR-CAP-ACC-BAT-004-01 - BR-CAP-ACC-BAT-004-08 - BR-CAP-ACC-BAT-016-10 - BR-CAP-ACC-BAT-016-11 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BatchPostingsPermissions' - key: accounting.batches.create intent: Create batches. operations: - createBatch surfaces: - api - console - job guarded_by: - BR-CAP-ACC-BAT-001-01 - BR-CAP-ACC-BAT-001-10 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BatchesPermissions' - key: accounting.batches.delete intent: Remove batches. operations: - deleteBatch surfaces: - api guarded_by: - BR-CAP-ACC-BAT-006-04 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BatchesPermissions' - key: accounting.batches.query intent: Query batches. operations: [] surfaces: - Platform query - api - console guarded_by: - BR-CAP-ACC-BAT-002-06 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BatchesPermissions' - key: accounting.batches.read intent: Read batches. operations: - listBatches - getDependentBatches - getBatch - listBatchActions - performBatchAction surfaces: - api - console - job guarded_by: - BR-CAP-ACC-BAT-002-06 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BatchesPermissions' - key: accounting.batches.update intent: Change batches. operations: - updateBatch - closeBatch - reopenBatch - archiveBatch - unarchiveBatch - listBatchActions - performBatchAction surfaces: - api - console - job guarded_by: - BR-CAP-ACC-BAT-003-01 - BR-CAP-ACC-BAT-003-03 - BR-CAP-ACC-BAT-003-06 - BR-CAP-ACC-BAT-003-07 - BR-CAP-ACC-BAT-003-08 - BR-CAP-ACC-BAT-004-01 - BR-CAP-ACC-BAT-004-08 - BR-CAP-ACC-BAT-007-01 - BR-CAP-ACC-BAT-007-05 - BR-CAP-ACC-BAT-007-07 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BatchesPermissions' - key: accounting.business-units.bulk intent: Perform bulk administration of business units. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BusinessUnitsPermissions' - key: accounting.business-units.create intent: Create business units. operations: - createBusinessUnit surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-001-03 - BR-CAP-ACC-BKS-001-04 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BusinessUnitsPermissions' - key: accounting.business-units.delete intent: Remove business units. operations: - deleteBusinessUnit surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-001-03 - BR-CAP-ACC-BKS-001-04 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BusinessUnitsPermissions' - key: accounting.business-units.query intent: Query business units. operations: [] surfaces: - Platform query - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BusinessUnitsPermissions' - key: accounting.business-units.read intent: Read business units. operations: - listBusinessUnits - getBusinessUnit - listDefaultGlAccounts surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-016-04 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BusinessUnitsPermissions' - key: accounting.business-units.update intent: Change business units. operations: - updateBusinessUnit - assignDefaultGlAccount - clearDefaultGlAccount surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-001-03 - BR-CAP-ACC-BKS-001-04 - BR-CAP-ACC-BKS-003-04 - BR-CAP-ACC-BKS-015-01 - BR-CAP-ACC-BKS-015-04 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:BusinessUnitsPermissions' - key: accounting.credit-applications.create intent: Create credit applications. operations: - applyCredit - reverseCreditApplication - settle surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-009-03 - BR-CAP-ACC-TRX-009-07 - BR-CAP-ACC-TRX-009-08 - BR-CAP-ACC-TRX-009-12 - BR-CAP-ACC-TRX-011-04 - BR-CAP-ACC-TRX-011-05 - BR-CAP-ACC-TRX-011-10 tier: user staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:CreditApplicationsPermissions - key: accounting.credit-applications.query intent: Query credit applications. operations: [] surfaces: - Platform query - api - console guarded_by: - BR-CAP-ACC-TRX-016-04 tier: read staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:CreditApplicationsPermissions - key: accounting.credit-applications.read intent: Read credit applications. operations: - getCreditApplication - listCreditApplications - getSettlement surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:CreditApplicationsPermissions - key: accounting.credit-applications.update intent: Change credit applications. operations: - reassignCreditApplicationBatch - updateCreditApplicationDetails surfaces: - api - console guarded_by: - BR-CAP-ACC-TRX-015-01 - BR-CAP-ACC-TRX-015-03 - BR-CAP-ACC-TRX-015-05 tier: user staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:CreditApplicationsPermissions - key: accounting.credit-memos.create intent: Create credit memos. operations: - createCreditMemo surfaces: - api - console guarded_by: - BR-CAP-ACC-TRX-003-01 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:CreditMemosPermissions' - key: accounting.credit-memos.query intent: Query credit memos. operations: [] surfaces: - Platform query - api - console guarded_by: - BR-CAP-ACC-TRX-016-04 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:CreditMemosPermissions' - key: accounting.credit-memos.read intent: Read credit memos. operations: - getCreditMemo - listCreditMemos - listCreditMemoActions - performCreditMemoAction surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:CreditMemosPermissions' - key: accounting.credit-memos.update intent: Change credit memos. operations: - reassignCreditMemoBatch - updateCreditMemoDetails - voidCreditMemo surfaces: - api - console guarded_by: - BR-CAP-ACC-TRX-003-01 - BR-CAP-ACC-TRX-015-01 - BR-CAP-ACC-TRX-015-03 - BR-CAP-ACC-TRX-015-05 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:CreditMemosPermissions' - key: accounting.credits.create intent: Create credits. operations: - createCredit surfaces: - api - console guarded_by: - BR-CAP-ACC-TRX-011-04 - BR-CAP-ACC-TRX-011-05 - BR-CAP-ACC-TRX-011-10 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:CreditsPermissions' - key: accounting.credits.query intent: Query credits. operations: [] surfaces: - Platform query - api - console guarded_by: - BR-CAP-ACC-TRX-016-04 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:CreditsPermissions' - key: accounting.credits.read intent: Read credits. operations: - getCredit - listCredits - listOpenCredits - listCreditActions - performCreditAction surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:CreditsPermissions' - key: accounting.credits.update intent: Change credits. operations: - reassignCreditBatch - updateCreditDetails - voidCredit surfaces: - api - console guarded_by: - BR-CAP-ACC-TRX-011-04 - BR-CAP-ACC-TRX-011-05 - BR-CAP-ACC-TRX-011-10 - BR-CAP-ACC-TRX-015-01 - BR-CAP-ACC-TRX-015-03 - BR-CAP-ACC-TRX-015-05 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:CreditsPermissions' - key: accounting.customer-terms.manage intent: Maintain customer collection terms. operations: - putCustomerTerms - deleteCustomerTerms surfaces: - api guarded_by: - BR-CAP-ACC-TRX-019-02 - BR-CAP-ACC-TRX-019-03 - BR-CAP-ACC-TRX-019-04 - BR-CAP-ACC-TRX-019-08 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:CustomerTermsActions' - key: accounting.customer-terms.read intent: Read customer collection terms. operations: - getCustomerTerms surfaces: - api guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:CustomerTermsActions' - key: accounting.debit-memos.create intent: Create debit memos. operations: - createDebitMemo surfaces: - api - console guarded_by: - BR-CAP-ACC-TRX-003-01 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DebitMemosPermissions' - key: accounting.debit-memos.query intent: Query debit memos. operations: [] surfaces: - Platform query - api - console guarded_by: - BR-CAP-ACC-TRX-016-04 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DebitMemosPermissions' - key: accounting.debit-memos.read intent: Read debit memos. operations: - getDebitMemo - listDebitMemos - listDebitMemoActions - performDebitMemoAction surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DebitMemosPermissions' - key: accounting.debit-memos.update intent: Change debit memos. operations: - reassignDebitMemoBatch - updateDebitMemoDetails - voidDebitMemo surfaces: - api - console guarded_by: - BR-CAP-ACC-TRX-003-01 - BR-CAP-ACC-TRX-015-01 - BR-CAP-ACC-TRX-015-03 - BR-CAP-ACC-TRX-015-05 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DebitMemosPermissions' - key: accounting.departments.bulk intent: Perform bulk administration of departments. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DepartmentsPermissions' - key: accounting.departments.create intent: Create departments. operations: - createDepartment surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DepartmentsPermissions' - key: accounting.departments.delete intent: Remove departments. operations: - deleteDepartment surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DepartmentsPermissions' - key: accounting.departments.read intent: Read departments. operations: - listDepartments - getDepartment surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DepartmentsPermissions' - key: accounting.departments.update intent: Change departments. operations: - updateDepartment surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DepartmentsPermissions' - key: accounting.disputes.create intent: Create disputes. operations: - openDispute surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-013-05 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DisputesPermissions' - key: accounting.disputes.read intent: Read disputes. operations: - getDispute - listPaymentDisputes surfaces: - api - console - job guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DisputesPermissions' - key: accounting.disputes.update intent: Change disputes. operations: - closeDispute surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-013-05 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DisputesPermissions' - key: accounting.document-templates.bulk intent: Perform bulk administration of document templates. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DocumentTemplatesPermissions' - key: accounting.document-templates.create intent: Create document templates. operations: - createDocumentTemplate - duplicateDocumentTemplate surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DocumentTemplatesPermissions' - key: accounting.document-templates.delete intent: Remove document templates. operations: - deleteDocumentTemplate surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DocumentTemplatesPermissions' - key: accounting.document-templates.read intent: Read document templates. operations: - listDocumentTemplates - getDocumentTemplate - previewDocumentTemplate - listDocumentTemplateVariables surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DocumentTemplatesPermissions' - key: accounting.document-templates.update intent: Change document templates. operations: - updateDocumentTemplate surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:DocumentTemplatesPermissions' - key: accounting.exchange-rates.bulk intent: Perform bulk administration of exchange rates. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ExchangeRatesPermissions' - key: accounting.exchange-rates.create intent: Create exchange rates. operations: - createExchangeRate - fillExchangeRates surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-004-03 - BR-CAP-ACC-BKS-004-07 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ExchangeRatesPermissions' - key: accounting.exchange-rates.delete intent: Remove exchange rates. operations: - deleteExchangeRate surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-004-03 - BR-CAP-ACC-BKS-004-07 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ExchangeRatesPermissions' - key: accounting.exchange-rates.read intent: Read exchange rates. operations: - listExchangeRates - resolveExchangeRate - getExchangeRate surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ExchangeRatesPermissions' - key: accounting.exchange-rates.update intent: Change exchange rates. operations: - updateExchangeRate surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-004-03 - BR-CAP-ACC-BKS-004-07 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ExchangeRatesPermissions' - key: accounting.expected-remittances.query intent: Query expected remittances. operations: [] surfaces: - Platform query - api guarded_by: [] tier: read staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:ExpectedRemittancesDatasetPermissions - key: accounting.fiscal-periods.close intent: Close fiscal periods. operations: - getFiscalCloseReadiness - getFiscalCloseAuthorization - closeFiscalPeriod - retryFiscalCloseRun - cancelFiscalCloseRun surfaces: - api - console - job guarded_by: - BR-CAP-ACC-CLS-002-01 - BR-CAP-ACC-CLS-008-01 - BR-CAP-ACC-CLS-008-03 - BR-CAP-ACC-CLS-008-05 - BR-CAP-ACC-CLS-008-06 - BR-CAP-ACC-CLS-008-10 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:FiscalPeriodActions' - key: accounting.fiscal-periods.read intent: Read fiscal periods. operations: - listFiscalClosePeriods - getFiscalCloseReadiness - getFiscalCloseAuthorization - listFiscalCloseRuns - getFiscalCloseRun - retryFiscalCloseRun - cancelFiscalCloseRun - getFiscalCloseRecord surfaces: - api - console - job guarded_by: - BR-CAP-ACC-CLS-002-08 - BR-CAP-ACC-CLS-007-06 - BR-CAP-ACC-CLS-013-06 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:FiscalPeriodActions' - key: accounting.fiscal-periods.reopen intent: Reopen fiscal periods. operations: - getFiscalCloseAuthorization - reopenFiscalPeriod - retryFiscalCloseRun - cancelFiscalCloseRun surfaces: - api - console - job guarded_by: - BR-CAP-ACC-CLS-002-02 - BR-CAP-ACC-CLS-011-01 - BR-CAP-ACC-CLS-011-03 - BR-CAP-ACC-CLS-011-05 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:FiscalPeriodActions' - key: accounting.fiscal-years.bulk intent: Perform bulk administration of fiscal years. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:FiscalYearsPermissions' - key: accounting.fiscal-years.create intent: Create fiscal years. operations: - generateFiscalYears surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-009-01 - BR-CAP-ACC-BKS-009-03 - BR-CAP-ACC-BKS-009-05 - BR-CAP-ACC-BKS-009-07 - BR-CAP-ACC-BKS-009-08 - BR-CAP-ACC-BKS-009-09 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:FiscalYearsPermissions' - key: accounting.fiscal-years.delete intent: Remove fiscal years. operations: - deleteFiscalYear surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-009-01 - BR-CAP-ACC-BKS-009-03 - BR-CAP-ACC-BKS-009-05 - BR-CAP-ACC-BKS-009-07 - BR-CAP-ACC-BKS-009-08 - BR-CAP-ACC-BKS-009-09 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:FiscalYearsPermissions' - key: accounting.fiscal-years.read intent: Read fiscal years. operations: - listFiscalYears - getFiscalYear - getCurrentFiscalPeriod - getFiscalPeriodForDate surfaces: - api - console - job guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:FiscalYearsPermissions' - key: accounting.fiscal-years.update intent: Change fiscal years. operations: - updateFiscalYear surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-009-01 - BR-CAP-ACC-BKS-009-03 - BR-CAP-ACC-BKS-009-05 - BR-CAP-ACC-BKS-009-07 - BR-CAP-ACC-BKS-009-08 - BR-CAP-ACC-BKS-009-09 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:FiscalYearsPermissions' - key: accounting.gl-accounts.bulk intent: Perform bulk administration of general ledger accounts. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:GlAccountsPermissions' - key: accounting.gl-accounts.create intent: Create general ledger accounts. operations: - createGlAccount surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:GlAccountsPermissions' - key: accounting.gl-accounts.delete intent: Remove general ledger accounts. operations: - deleteGlAccount surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:GlAccountsPermissions' - key: accounting.gl-accounts.read intent: Read general ledger accounts. operations: - listGlAccounts - getGlAccount surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:GlAccountsPermissions' - key: accounting.gl-accounts.update intent: Change general ledger accounts. operations: - updateGlAccount surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:GlAccountsPermissions' - key: accounting.invoices.adjust intent: Adjust invoices. operations: - issueInvoice - convertProFormaInvoice - amendInvoice surfaces: - api - console guarded_by: - BR-CAP-ACC-TRX-001-01 - BR-CAP-ACC-TRX-001-07 - BR-CAP-ACC-TRX-001-08 - BR-CAP-ACC-TRX-001-10 - BR-CAP-ACC-TRX-001-11 - BR-CAP-ACC-TRX-001-12 - BR-CAP-ACC-TRX-001-13 - BR-CAP-ACC-TRX-002-10 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:InvoicesPermissions' - key: accounting.invoices.create intent: Create invoices. operations: - createInvoiceDraft - updateInvoiceDraft surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-001-01 - BR-CAP-ACC-TRX-001-07 - BR-CAP-ACC-TRX-001-08 - BR-CAP-ACC-TRX-001-10 - BR-CAP-ACC-TRX-001-11 - BR-CAP-ACC-TRX-001-12 - BR-CAP-ACC-TRX-001-13 - BR-CAP-ACC-TRX-020-04 - BR-CAP-ACC-TRX-020-05 - BR-CAP-ACC-TRX-020-11 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:InvoicesPermissions' - key: accounting.invoices.delete intent: Remove invoices. operations: - deleteInvoiceDraft surfaces: - api - console guarded_by: - BR-CAP-ACC-TRX-001-01 - BR-CAP-ACC-TRX-001-07 - BR-CAP-ACC-TRX-001-08 - BR-CAP-ACC-TRX-001-10 - BR-CAP-ACC-TRX-001-11 - BR-CAP-ACC-TRX-001-12 - BR-CAP-ACC-TRX-001-13 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:InvoicesPermissions' - key: accounting.invoices.email intent: Send an invoice communication to its selected recipients. operations: - emailInvoice surfaces: - api guarded_by: [] tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:InvoicesPermissions' - key: accounting.invoices.query intent: Query invoices. operations: [] surfaces: - Platform query - api - console guarded_by: - BR-CAP-ACC-TRX-016-04 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:InvoicesPermissions' - key: accounting.invoices.read intent: Read invoices. operations: - getInvoice - listInvoices - describePayableInvoice - describePayableInvoices - listOpenInvoices - renderInvoice - listInvoiceActions - performInvoiceAction - listExpectedRemittances - listServicePeriods - summarizeCustomer surfaces: - api - console guarded_by: - BR-CAP-ACC-TRX-016-04 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:InvoicesPermissions' - key: accounting.invoices.update intent: Change invoices. operations: - reassignInvoiceBatch - changeInvoiceDueDate - changeInvoiceTerms - updateInvoiceDetails surfaces: - api - console guarded_by: - BR-CAP-ACC-TRX-002-10 - BR-CAP-ACC-TRX-015-01 - BR-CAP-ACC-TRX-015-03 - BR-CAP-ACC-TRX-015-05 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:InvoicesPermissions' - key: accounting.invoices.void intent: Void invoices. operations: - voidInvoice surfaces: - api - console guarded_by: - BR-CAP-ACC-TRX-002-10 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:InvoicesPermissions' - key: accounting.merchant-accounts.bulk intent: Perform bulk administration of merchant accounts. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:MerchantAccountsPermissions' - key: accounting.merchant-accounts.create intent: Create merchant accounts. operations: - createMerchantAccount surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:MerchantAccountsPermissions' - key: accounting.merchant-accounts.delete intent: Remove merchant accounts. operations: - deleteMerchantAccount surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:MerchantAccountsPermissions' - key: accounting.merchant-accounts.read intent: Read merchant accounts. operations: - listMerchantAccounts - getMerchantAccount surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:MerchantAccountsPermissions' - key: accounting.merchant-accounts.update intent: Change merchant accounts. operations: - updateMerchantAccount surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:MerchantAccountsPermissions' - key: accounting.payment-element.create intent: Create a processor setup intent for payment-method entry. operations: - createStripeSetupIntent surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-007-12 - BR-CAP-ACC-TRX-007-13 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentElementPermissions' - key: accounting.payment-element.read intent: Read processor payment-entry information. operations: - getPaymentClientSideInfo - getStripeClientSideInfo surfaces: - api - console - job guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentElementPermissions' - key: accounting.payment-methods.bulk intent: Perform bulk administration of payment methods. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentMethodsPermissions' - key: accounting.payment-methods.create intent: Create payment methods. operations: - createPaymentMethod surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentMethodsPermissions' - key: accounting.payment-methods.delete intent: Remove payment methods. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentMethodsPermissions' - key: accounting.payment-methods.read intent: Read payment methods. operations: - listPaymentMethods - getPaymentMethod surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentMethodsPermissions' - key: accounting.payment-methods.update intent: Change payment methods. operations: - updatePaymentMethod surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentMethodsPermissions' - key: accounting.payment-terms.bulk intent: Perform bulk administration of payment terms. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentTermsPermissions' - key: accounting.payment-terms.create intent: Create payment terms. operations: - createPaymentTerms surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-011-02 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentTermsPermissions' - key: accounting.payment-terms.delete intent: Remove payment terms. operations: - deletePaymentTerms surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-011-02 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentTermsPermissions' - key: accounting.payment-terms.read intent: Read payment terms. operations: - listPaymentTerms - getPaymentTerms surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentTermsPermissions' - key: accounting.payment-terms.update intent: Change payment terms. operations: - updatePaymentTerms surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-011-02 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentTermsPermissions' - key: accounting.payments.create intent: Create payments. operations: - receivePayment - settle - recordRemittance surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-006-05 - BR-CAP-ACC-TRX-006-09 - BR-CAP-ACC-TRX-007-12 - BR-CAP-ACC-TRX-007-13 - BR-CAP-ACC-TRX-009-03 - BR-CAP-ACC-TRX-009-07 - BR-CAP-ACC-TRX-009-08 - BR-CAP-ACC-TRX-009-12 - BR-CAP-ACC-TRX-020-04 - BR-CAP-ACC-TRX-020-05 - BR-CAP-ACC-TRX-020-11 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentsPermissions' - key: accounting.payments.query intent: Query payments. operations: [] surfaces: - Platform query - api - console guarded_by: - BR-CAP-ACC-TRX-016-04 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentsPermissions' - key: accounting.payments.read intent: Read payments. operations: - getPayment - listPayments - listUnappliedPayments - getPaymentIntent - listPaymentActions - performPaymentAction - listPaymentReversals - getSettlement - listRemittances - getRemittance surfaces: - api - console - job guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentsPermissions' - key: accounting.payments.reverse intent: Reverse payments. operations: - reversePayment surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-013-05 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentsPermissions' - key: accounting.payments.settle intent: Let Rhythm staff mark an eligible electronic-check receipt as cleared. operations: - markPaymentSettled surfaces: - api - console - job - system guarded_by: - BR-CAP-ACC-TRX-007-10 - BR-CAP-ACC-TRX-007-11 tier: user staff_only: true provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentsPermissions' - key: accounting.payments.update intent: Change payments. operations: - reassignPaymentBatch - updatePaymentDetails - allocatePayment - reallocatePayment - failLostAnswer - settleLostAnswer surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-007-12 - BR-CAP-ACC-TRX-007-13 - BR-CAP-ACC-TRX-008-01 - BR-CAP-ACC-TRX-008-02 - BR-CAP-ACC-TRX-008-06 - BR-CAP-ACC-TRX-015-01 - BR-CAP-ACC-TRX-015-03 - BR-CAP-ACC-TRX-015-05 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentsPermissions' - key: accounting.payments.void intent: Void payments. operations: - voidPayment - voidRemittance surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-013-05 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PaymentsPermissions' - key: accounting.payouts.create intent: Create payouts. operations: - createPayout surfaces: - api - console guarded_by: - BR-CAP-ACC-REC-001-07 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PayoutActions' - key: accounting.payouts.delete intent: Remove payouts. operations: - voidPayout surfaces: - api guarded_by: - BR-CAP-ACC-REC-002-01 - BR-CAP-ACC-REC-002-03 - BR-CAP-ACC-REC-002-06 - BR-CAP-ACC-REC-002-09 - BR-CAP-ACC-REC-002-10 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PayoutActions' - key: accounting.payouts.read intent: Read payouts. operations: - listPayouts - checkPayoutDuplicates - getPayout - listPayoutEvents surfaces: - api - console guarded_by: - BR-CAP-ACC-REC-004-08 - BR-CAP-ACC-REC-020-07 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PayoutActions' - key: accounting.payouts.update intent: Change payouts. operations: - updatePayout - attachPayoutEvidence surfaces: - api guarded_by: - BR-CAP-ACC-REC-002-01 - BR-CAP-ACC-REC-002-03 - BR-CAP-ACC-REC-002-06 - BR-CAP-ACC-REC-002-09 - BR-CAP-ACC-REC-002-10 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PayoutActions' - key: accounting.payouts.verify intent: Verify payouts. operations: - verifyPayoutBank surfaces: - api - console guarded_by: - BR-CAP-ACC-REC-003-01 - BR-CAP-ACC-REC-003-02 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:PayoutActions' - key: accounting.product-accounting.delete intent: Remove product accounting setups. operations: - deleteProductAccounting surfaces: - api - console guarded_by: - BR-CAP-ACC-PRD-015-03 - BR-CAP-ACC-PRD-015-07 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ProductAccountingPermissions' - key: accounting.product-accounting.read intent: Read product accounting setups. operations: - getProductAccounting - listProductsWithoutAccounting surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ProductAccountingPermissions' - key: accounting.product-accounting.update intent: Change product accounting setups. operations: - replaceProductAccounting - replaceProductAccountings surfaces: - api - console guarded_by: - BR-CAP-ACC-PRD-015-03 - BR-CAP-ACC-PRD-015-07 - BR-CAP-ACC-PRD-017-01 - BR-CAP-ACC-PRD-017-04 - BR-CAP-ACC-PRD-017-05 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ProductAccountingPermissions' - key: accounting.products.create intent: Create products. operations: - createProduct surfaces: - api - console - job guarded_by: - BR-CAP-ACC-PRD-002-03 - BR-CAP-ACC-PRD-002-04 - BR-CAP-ACC-PRD-008-03 - BR-CAP-ACC-PRD-008-04 - BR-CAP-ACC-PRD-008-05 - BR-CAP-ACC-PRD-008-10 - BR-CAP-ACC-PRD-008-13 - BR-CAP-ACC-PRD-008-15 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ProductsPermissions' - key: accounting.products.delete intent: Remove products. operations: - deleteProduct surfaces: - api - console - job guarded_by: - BR-CAP-ACC-PRD-006-01 - BR-CAP-ACC-PRD-006-02 - BR-CAP-ACC-PRD-006-04 - BR-CAP-ACC-PRD-006-05 - BR-CAP-ACC-PRD-006-09 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ProductsPermissions' - key: accounting.products.read intent: Read products. operations: - listProductTypes - listProducts - getProduct surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ProductsPermissions' - key: accounting.products.update intent: Change products. operations: - updateProduct - retireProduct - reactivateProduct surfaces: - api - console - job guarded_by: - BR-CAP-ACC-PRD-004-01 - BR-CAP-ACC-PRD-004-03 - BR-CAP-ACC-PRD-004-04 - BR-CAP-ACC-PRD-004-05 - BR-CAP-ACC-PRD-005-02 - BR-CAP-ACC-PRD-005-03 - BR-CAP-ACC-PRD-005-04 - BR-CAP-ACC-PRD-005-05 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ProductsPermissions' - key: accounting.reconciliation-batches.create intent: Create reconciliation batches. operations: - createReconciliationBatch surfaces: - api - console guarded_by: - BR-CAP-ACC-REC-008-04 - BR-CAP-ACC-REC-008-08 - BR-CAP-ACC-REC-008-09 - BR-CAP-ACC-REC-008-10 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ReconciliationBatchActions' - key: accounting.reconciliation-batches.delete intent: Remove reconciliation batches. operations: - voidReconciliationBatch surfaces: - api guarded_by: - BR-CAP-ACC-REC-012-01 - BR-CAP-ACC-REC-012-05 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ReconciliationBatchActions' - key: accounting.reconciliation-batches.finalize intent: Finalize reconciliation batches. operations: - finalizeReconciliationBatch surfaces: - api - console guarded_by: - BR-CAP-ACC-REC-011-01 - BR-CAP-ACC-REC-011-02 - BR-CAP-ACC-REC-011-03 - BR-CAP-ACC-REC-011-05 - BR-CAP-ACC-REC-011-07 - BR-CAP-ACC-REC-011-11 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ReconciliationBatchActions' - key: accounting.reconciliation-batches.read intent: Read reconciliation batches. operations: - listReconciliationBatches - getReconciliationBatch - listReconciliationCandidates - listReconciliationSourceBatches - listReconciliationBatchEvents - getReconciliationReadiness - getReconciliationOverview surfaces: - api - console - job guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ReconciliationBatchActions' - key: accounting.reconciliation-batches.reverse intent: Reverse reconciliation batches. operations: - reverseReconciliationBatch - approveReconciliationBatchReversal surfaces: - api - console guarded_by: - BR-CAP-ACC-REC-013-01 - BR-CAP-ACC-REC-013-02 - BR-CAP-ACC-REC-013-03 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ReconciliationBatchActions' - key: accounting.reconciliation-batches.update intent: Change reconciliation batches. operations: - updateReconciliationBatchNotes - claimReconciliationItems - releaseReconciliationItems - acceptAuthoritativeCandidates - addReconciliationManualItem - removeReconciliationManualItem - dismissReconciliationItem - undismissReconciliationItem surfaces: - api - console guarded_by: - BR-CAP-ACC-REC-008-04 - BR-CAP-ACC-REC-008-08 - BR-CAP-ACC-REC-008-09 - BR-CAP-ACC-REC-008-10 - BR-CAP-ACC-REC-009-01 - BR-CAP-ACC-REC-009-04 - BR-CAP-ACC-REC-009-06 - BR-CAP-ACC-REC-009-07 - BR-CAP-ACC-REC-010-04 - BR-CAP-ACC-REC-010-07 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ReconciliationBatchActions' - key: accounting.reconciliation-exceptions.accept intent: Accept reconciliation exceptions. operations: - acceptReconciliationException - approveReconciliationExceptionAcceptance - withdrawReconciliationExceptionAcceptance - runReconciliationScheduledWork surfaces: - api - console - job guarded_by: - BR-CAP-ACC-REC-016-01 - BR-CAP-ACC-REC-016-02 - BR-CAP-ACC-REC-016-03 - BR-CAP-ACC-REC-016-05 - BR-CAP-ACC-REC-016-06 - BR-CAP-ACC-REC-016-07 - BR-CAP-ACC-REC-016-09 tier: admin staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:ReconciliationExceptionActions - key: accounting.reconciliation-exceptions.read intent: Read reconciliation exceptions. operations: - listReconciliationExceptions - getReconciliationException surfaces: - api - console - job guarded_by: [] tier: read staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:ReconciliationExceptionActions - key: accounting.reconciliation-exceptions.update intent: Change reconciliation exceptions. operations: - createReconciliationException - updateReconciliationException - addReconciliationExceptionNote - setReconciliationExceptionStep - resolveReconciliationException surfaces: - api - console guarded_by: - BR-CAP-ACC-REC-015-01 - BR-CAP-ACC-REC-015-04 - BR-CAP-ACC-REC-015-08 - BR-CAP-ACC-REC-015-09 - BR-CAP-ACC-REC-015-12 tier: user staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:ReconciliationExceptionActions - key: accounting.recurring-batches.create intent: Create recurring batches. operations: - createRecurringBatch surfaces: - api - console guarded_by: - BR-CAP-ACC-BAT-009-05 - BR-CAP-ACC-BAT-009-08 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:RecurringBatchesPermissions' - key: accounting.recurring-batches.delete intent: Remove recurring batches. operations: - deleteRecurringBatch surfaces: - api - console guarded_by: - BR-CAP-ACC-BAT-009-05 - BR-CAP-ACC-BAT-009-08 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:RecurringBatchesPermissions' - key: accounting.recurring-batches.read intent: Read recurring batches. operations: - listRecurringBatches - getRecurringBatch - listRecurringBatchRuns - previewRecurringBatchRoll surfaces: - api - console - job guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:RecurringBatchesPermissions' - key: accounting.recurring-batches.update intent: Change recurring batches. operations: - updateRecurringBatch surfaces: - api - console guarded_by: - BR-CAP-ACC-BAT-009-05 - BR-CAP-ACC-BAT-009-08 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:RecurringBatchesPermissions' - key: accounting.recurring-billing-runs.read intent: Read recurring billing runs. operations: [] surfaces: - api - console - job guarded_by: [] tier: read staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:RecurringBillingRunsPermissions - key: accounting.refunds.approve intent: Approve refunds. operations: - approveRefund surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-012-05 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:RefundsPermissions' - key: accounting.refunds.create intent: Create refunds. operations: - requestRefund - cancelRefund surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-012-01 - BR-CAP-ACC-TRX-012-02 - BR-CAP-ACC-TRX-012-06 - BR-CAP-ACC-TRX-012-10 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:RefundsPermissions' - key: accounting.refunds.execute intent: Execute refunds. operations: - executeRefund surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-012-03 - BR-CAP-ACC-TRX-012-06 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:RefundsPermissions' - key: accounting.refunds.query intent: Query refunds. operations: [] surfaces: - Platform query - api - console guarded_by: - BR-CAP-ACC-TRX-016-04 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:RefundsPermissions' - key: accounting.refunds.read intent: Read refunds. operations: - getRefund - listRefunds - listRefundActions - performRefundAction surfaces: - api - console - job guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:RefundsPermissions' - key: accounting.remittances.create intent: Create remittances. operations: - recordRemittance surfaces: - api guarded_by: - BR-CAP-ACC-TRX-010-01 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:RemittanceActions' - key: accounting.remittances.read intent: Read remittances. operations: - listRemittances - getRemittance - listExpectedRemittances surfaces: - api guarded_by: - BR-CAP-ACC-TRX-010-01 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:RemittanceActions' - key: accounting.remittances.void intent: Void remittances. operations: - voidRemittance surfaces: - api guarded_by: - BR-CAP-ACC-TRX-010-01 - BR-CAP-ACC-TRX-010-07 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:RemittanceActions' - key: accounting.revenue-schedule-entries.query intent: Query revenue schedule entries. operations: [] surfaces: - Platform query - api - console - job guarded_by: [] tier: read staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:RevenueScheduleEntriesDatasetPermissions - key: accounting.reversals.create intent: Create reversals. operations: - reverseBilling surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-014-01 - BR-CAP-ACC-TRX-020-04 - BR-CAP-ACC-TRX-020-05 - BR-CAP-ACC-TRX-020-11 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ReversalsPermissions' - key: accounting.reversals.preview intent: Preview reversals. operations: - previewReversal surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ReversalsPermissions' - key: accounting.reversals.read intent: Read reversals. operations: - getReversal surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:ReversalsPermissions' - key: accounting.settings.bulk intent: Perform bulk administration of settings. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:SettingsPermissions' - key: accounting.settings.create intent: Create settings. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:SettingsPermissions' - key: accounting.settings.delete intent: Remove settings. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:SettingsPermissions' - key: accounting.settings.read intent: Read settings. operations: - getSettings surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:SettingsPermissions' - key: accounting.settings.update intent: Change settings. operations: - updateSettings surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-015-01 - BR-CAP-ACC-BKS-015-04 - BR-CAP-ACC-BKS-017-01 - BR-CAP-ACC-BKS-017-03 - BR-CAP-ACC-BKS-017-06 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:SettingsPermissions' - key: accounting.settlement-items.read intent: Read settlement items. operations: - listSettlementItems - summarizeSettlementItems - getSettlementItem surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:SettlementItemActions' - key: accounting.settlement-items.resolve intent: Resolve settlement items. operations: - splitSettlementItem - resolveSettlementItem surfaces: - api - console guarded_by: - BR-CAP-ACC-REC-007-01 - BR-CAP-ACC-REC-007-02 - BR-CAP-ACC-REC-007-05 - BR-CAP-ACC-REC-007-07 - BR-CAP-ACC-REC-007-09 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:SettlementItemActions' - key: accounting.settlements.create intent: Create settlements. operations: - settle surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-009-01 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:SettlementActions' - key: accounting.settlements.read intent: Read settlements. operations: - getSettlement surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-009-01 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:SettlementActions' - key: accounting.stripe-settings.read intent: Read legacy Stripe configuration. operations: - getStripeSettings surfaces: - api - console - job guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:StripeSettingsPermissions' - key: accounting.stripe-settings.update intent: Change legacy Stripe configuration. operations: - saveStripeSettings surfaces: - api - console - job guarded_by: - BR-CAP-ACC-TRX-007-12 - BR-CAP-ACC-TRX-007-13 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:StripeSettingsPermissions' - key: accounting.subledger-entries.read intent: Read subledger entries. operations: - listSubledgerEntries - getSubledgerEntry - describeInvoiceLineRevenue surfaces: - api - console - job guarded_by: - BR-CAP-ACC-BAT-018-05 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:SubledgerEntriesPermissions' - key: accounting.subledger-entry-lines.query intent: Query subledger entry lines. operations: [] surfaces: - Platform query - api - console guarded_by: - BR-CAP-ACC-BAT-018-05 tier: read staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:SubledgerEntryLinesDatasetPermissions - key: accounting.tax-classes.bulk intent: Perform bulk administration of tax classes. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:TaxClassesPermissions' - key: accounting.tax-classes.create intent: Create tax classes. operations: - createTaxClass surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-013-08 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:TaxClassesPermissions' - key: accounting.tax-classes.delete intent: Remove tax classes. operations: - deleteTaxClass - deleteProductTypeTaxClass surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-013-08 - BR-CAP-ACC-PRD-018-01 - BR-CAP-ACC-PRD-018-02 - BR-CAP-ACC-PRD-018-03 - BR-CAP-ACC-PRD-018-04 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:TaxClassesPermissions' - key: accounting.tax-classes.read intent: Read tax classes. operations: - listTaxClasses - getTaxClass - listProductTypeTaxClasses - getProductTypeTaxClass surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:TaxClassesPermissions' - key: accounting.tax-classes.update intent: Change tax classes. operations: - updateTaxClass - replaceProductTypeTaxClass surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-013-08 - BR-CAP-ACC-PRD-018-01 - BR-CAP-ACC-PRD-018-02 - BR-CAP-ACC-PRD-018-03 - BR-CAP-ACC-PRD-018-04 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:TaxClassesPermissions' - key: accounting.tax-zones.bulk intent: Perform bulk administration of tax zones. operations: [] surfaces: - api - console guarded_by: [] tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:TaxZonesPermissions' - key: accounting.tax-zones.create intent: Create tax zones. operations: - createTaxZone surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-013-08 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:TaxZonesPermissions' - key: accounting.tax-zones.delete intent: Remove tax zones. operations: - deleteTaxZone surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-013-08 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:TaxZonesPermissions' - key: accounting.tax-zones.read intent: Read tax zones. operations: - listTaxZones - getTaxZone surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:TaxZonesPermissions' - key: accounting.tax-zones.update intent: Change tax zones. operations: - updateTaxZone surfaces: - api - console guarded_by: - BR-CAP-ACC-BKS-013-08 tier: admin staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:TaxZonesPermissions' - key: accounting.tax.calculate intent: Calculate tax on priced lines. operations: - calculateTax surfaces: - api - console - job guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:TaxPermissions' - key: accounting.transactions.query intent: Query transactions. operations: [] surfaces: - Platform query - api - console guarded_by: - BR-CAP-ACC-TRX-016-04 tier: read staff_only: false provenance: observed source: >- services-accounting:aws/accounting.service.ts:TransactionsDatasetPermissions - key: accounting.write-offs.create intent: Create write offs. operations: - createWriteOff surfaces: - api - console guarded_by: - BR-CAP-ACC-TRX-004-01 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:WriteOffsPermissions' - key: accounting.write-offs.query intent: Query write offs. operations: [] surfaces: - Platform query - api - console guarded_by: - BR-CAP-ACC-TRX-016-04 tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:WriteOffsPermissions' - key: accounting.write-offs.read intent: Read write offs. operations: - getWriteOff - listWriteOffs - listWriteOffActions - performWriteOffAction surfaces: - api - console guarded_by: [] tier: read staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:WriteOffsPermissions' - key: accounting.write-offs.update intent: Change write offs. operations: - reassignWriteOffBatch - updateWriteOffDetails - reverseWriteOff surfaces: - api - console guarded_by: - BR-CAP-ACC-TRX-004-01 - BR-CAP-ACC-TRX-015-01 - BR-CAP-ACC-TRX-015-03 - BR-CAP-ACC-TRX-015-05 tier: user staff_only: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:WriteOffsPermissions' - key: >- none: public health route (the operation name follows the getHealth pattern of the shared health route) intent: >- Identify an operation whose access uses its public, internal or machine boundary rather than a customer permission key. operations: - getBatchesHealth surfaces: - public guarded_by: [] requirement_type: non-permission access boundary constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/batches/design/contracts/SVC-ACC-BAT-batches.md#operations - key: >- accounting.batches.read (also evaluates accounting.batches.update, accounting.batch-postings.post, accounting.batch-postings.unpost) intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - listBatchActions surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.batches.read - accounting.batches.update - accounting.batch-postings.post - accounting.batch-postings.unpost provenance: documented source: >- rhythm-v2-docs:specs/accounting/batches/design/contracts/SVC-ACC-BAT-batches.md#operations - key: >- accounting.batches.read to reach the handler, then the action's own key (accounting.batches.update, accounting.batch-postings.post or accounting.batch-postings.unpost) intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - performBatchAction surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.batches.read - accounting.batches.update - accounting.batch-postings.post - accounting.batch-postings.unpost provenance: documented source: >- rhythm-v2-docs:specs/accounting/batches/design/contracts/SVC-ACC-BAT-batches.md#operations - key: >- none: called in-process inside fiscal close's transaction, which fiscal close authorizes intent: >- Identify an operation whose access uses its public, internal or machine boundary rather than a customer permission key. operations: - postSystemBatch surfaces: - internal guarded_by: [] requirement_type: non-permission access boundary constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/batches/design/contracts/SVC-ACC-BAT-batches.md#operations - key: 'none: called in-process inside fiscal close''s transaction' intent: >- Identify an operation whose access uses its public, internal or machine boundary rather than a customer permission key. operations: - reverseSystemBatch - recogniseDueEntries - unrecogniseEntries surfaces: - internal guarded_by: [] requirement_type: non-permission access boundary constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/batches/design/contracts/SVC-ACC-BAT-batches.md#operations; rhythm-v2-docs:specs/accounting/batches/design/contracts/SVC-ACC-BAT-batches.md#operations; rhythm-v2-docs:specs/accounting/batches/design/contracts/SVC-ACC-BAT-batches.md#operations - key: >- none: document callers authorize their own operation before in-process selection intent: >- Identify an operation whose access uses its public, internal or machine boundary rather than a customer permission key. operations: - defaultBatchFor surfaces: - internal guarded_by: [] requirement_type: non-permission access boundary constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/batches/design/contracts/SVC-ACC-BAT-batches.md#operations - key: 'none: public health route' intent: >- Identify an operation whose access uses its public, internal or machine boundary rather than a customer permission key. operations: - getConfigurationHealth - getSchedulingHealth - getProductsHealth surfaces: - public guarded_by: [] requirement_type: non-permission access boundary constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/books/design/contracts/SVC-ACC-BKS-books.md#operations; rhythm-v2-docs:specs/accounting/books/design/contracts/SVC-ACC-BKS-maintenance.md#operations; rhythm-v2-docs:specs/accounting/products/design/contracts/SVC-ACC-PRD-products.md#operations - key: >- accounting.application.access, plus the owning record's read permission checked by the handler (recurring-batches, batches, reconciliation-exceptions, reconciliation-batches or recurring-billing-runs read) intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - listScheduleRuns surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.application.access provenance: documented source: >- rhythm-v2-docs:specs/accounting/books/design/contracts/SVC-ACC-BKS-maintenance.md#operations - key: 'none: invoked by Platform''s lifecycle jobs under the service role' intent: >- Identify an operation whose access uses its public, internal or machine boundary rather than a customer permission key. operations: - describe - inventory surfaces: - internal guarded_by: [] requirement_type: non-permission access boundary constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/books/design/contracts/SVC-ACC-BKS-maintenance.md#operations; rhythm-v2-docs:specs/accounting/books/design/contracts/SVC-ACC-BKS-maintenance.md#operations - key: 'none: invoked by Platform''s provisioning job under the service role' intent: >- Identify an operation whose access uses its public, internal or machine boundary rather than a customer permission key. operations: - provision - verifyProvisioned surfaces: - internal guarded_by: [] requirement_type: non-permission access boundary constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/books/design/contracts/SVC-ACC-BKS-maintenance.md#operations; rhythm-v2-docs:specs/accounting/books/design/contracts/SVC-ACC-BKS-maintenance.md#operations - key: 'none: invoked by Platform''s deletion job under the service role' intent: >- Identify an operation whose access uses its public, internal or machine boundary rather than a customer permission key. operations: - purge surfaces: - internal guarded_by: [] requirement_type: non-permission access boundary constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/books/design/contracts/SVC-ACC-BKS-maintenance.md#operations - key: 'none: invoked by Platform''s export job under the service role' intent: >- Identify an operation whose access uses its public, internal or machine boundary rather than a customer permission key. operations: - export surfaces: - internal guarded_by: [] requirement_type: non-permission access boundary constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/books/design/contracts/SVC-ACC-BKS-maintenance.md#operations - key: accounting.fiscal-periods.read (evaluates accounting.fiscal-periods.close) intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - getFiscalCloseReadiness surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.fiscal-periods.read - accounting.fiscal-periods.close provenance: documented source: >- rhythm-v2-docs:specs/accounting/close/design/contracts/SVC-ACC-CLS-fiscal-close.md#operations - key: >- accounting.fiscal-periods.read (evaluates accounting.fiscal-periods.close and accounting.fiscal-periods.reopen) intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - getFiscalCloseAuthorization surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.fiscal-periods.read - accounting.fiscal-periods.close - accounting.fiscal-periods.reopen provenance: documented source: >- rhythm-v2-docs:specs/accounting/close/design/contracts/SVC-ACC-CLS-fiscal-close.md#operations - key: >- accounting.fiscal-periods.read, then accounting.fiscal-periods.close or accounting.fiscal-periods.reopen by the run's kind intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - retryFiscalCloseRun - cancelFiscalCloseRun surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.fiscal-periods.read - accounting.fiscal-periods.close - accounting.fiscal-periods.reopen provenance: documented source: >- rhythm-v2-docs:specs/accounting/close/design/contracts/SVC-ACC-CLS-fiscal-close.md#operations; rhythm-v2-docs:specs/accounting/close/design/contracts/SVC-ACC-CLS-fiscal-close.md#operations - key: >- EXECUTE held by the capability role rhythm_accounting_product_writer, granted to each macroservice application role; owner rule from the session role intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - accounting.save_product surfaces: - internal guarded_by: [] requirement_type: composite operation requirement constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/products/design/contracts/SVC-ACC-PRD-products.md#operations - key: >- EXECUTE held by the capability role rhythm_accounting_product_writer; owner rule from the session role intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - accounting.retire_product surfaces: - internal guarded_by: [] requirement_type: composite operation requirement constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/products/design/contracts/SVC-ACC-PRD-products.md#operations - key: SQL function under the caller's own workspace policy (security invoker) intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - accounting.resolve_product_tax_class surfaces: - internal guarded_by: [] requirement_type: composite operation requirement constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/products/design/contracts/SVC-ACC-PRD-products.md#operations - key: >- none: an in-process call that runs in the caller's authorized transaction and refuses without one intent: >- Identify an operation whose access uses its public, internal or machine boundary rather than a customer permission key. operations: - recordSettlementItem surfaces: - internal guarded_by: [] requirement_type: non-permission access boundary constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/reconciliation/design/contracts/SVC-ACC-REC-reconciliation.md#operations - key: 'none: an in-process call inside the caller''s transaction' intent: >- Identify an operation whose access uses its public, internal or machine boundary rather than a customer permission key. operations: - markSettlementItemEligible - assessReconciliationReadiness - assertPeriodWritable surfaces: - internal guarded_by: [] requirement_type: non-permission access boundary constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/reconciliation/design/contracts/SVC-ACC-REC-reconciliation.md#operations; rhythm-v2-docs:specs/accounting/reconciliation/design/contracts/SVC-ACC-REC-reconciliation.md#operations; rhythm-v2-docs:specs/accounting/reconciliation/design/contracts/SVC-ACC-REC-reconciliation.md#operations - key: 'none: an in-process read inside Batch Management''s posting transaction' intent: >- Identify an operation whose access uses its public, internal or machine boundary rather than a customer permission key. operations: - listPostingsInBatches surfaces: - internal guarded_by: [] requirement_type: non-permission access boundary constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/reconciliation/design/contracts/SVC-ACC-REC-reconciliation.md#operations - key: 'none: an in-process read' intent: >- Identify an operation whose access uses its public, internal or machine boundary rather than a customer permission key. operations: - listPendingPostings - loadPosting surfaces: - internal guarded_by: [] requirement_type: non-permission access boundary constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/reconciliation/design/contracts/SVC-ACC-REC-reconciliation.md#operations; rhythm-v2-docs:specs/accounting/reconciliation/design/contracts/SVC-ACC-REC-reconciliation.md#operations - key: 'none: public route' intent: >- Identify an operation whose access uses its public, internal or machine boundary rather than a customer permission key. operations: - getTransactionsHealth - receiveStripeWebhook surfaces: - public guarded_by: [] requirement_type: non-permission access boundary constituent_permissions: [] provenance: documented source: >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations; rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations - key: >- accounting.invoices.read at the route; the chosen action’s own authority inside the command intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - performInvoiceAction surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.invoices.read provenance: documented source: >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations - key: >- accounting.credit-memos.read at the route; the chosen action’s own authority inside the command intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - performCreditMemoAction surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.credit-memos.read provenance: documented source: >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations - key: >- accounting.debit-memos.read at the route; the chosen action’s own authority inside the command intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - performDebitMemoAction surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.debit-memos.read provenance: documented source: >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations - key: >- accounting.write-offs.read at the route; the chosen action’s own authority inside the command intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - performWriteOffAction surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.write-offs.read provenance: documented source: >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations - key: >- accounting.payments.read at the route; the chosen action’s own authority inside the command intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - performPaymentAction surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.payments.read provenance: documented source: >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations - key: >- accounting.credits.read at the route; the chosen action’s own authority inside the command intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - performCreditAction surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.credits.read provenance: documented source: >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations - key: >- accounting.refunds.read at the route; the chosen action’s own authority inside the command intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - performRefundAction surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.refunds.read provenance: documented source: >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations - key: >- accounting.settlements.create + accounting.payments.create + accounting.credit-applications.create intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - settle surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.settlements.create - accounting.payments.create - accounting.credit-applications.create provenance: documented source: >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations - key: >- accounting.settlements.read AND (accounting.payments.read OR accounting.credit-applications.read) intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - getSettlement surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.settlements.read - accounting.payments.read - accounting.credit-applications.read provenance: documented source: >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations - key: accounting.remittances.create + accounting.payments.create intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - recordRemittance surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.remittances.create - accounting.payments.create provenance: documented source: >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations - key: accounting.remittances.read + accounting.payments.read intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - listRemittances - getRemittance surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.remittances.read - accounting.payments.read provenance: documented source: >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations; rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations - key: accounting.remittances.void + accounting.payments.void intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - voidRemittance surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.remittances.void - accounting.payments.void provenance: documented source: >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations - key: accounting.remittances.read + accounting.invoices.read intent: >- Require the declared combination of permissions and any action-specific or owning-record checks. operations: - listExpectedRemittances surfaces: - console guarded_by: [] requirement_type: composite operation requirement constituent_permissions: - accounting.remittances.read - accounting.invoices.read provenance: documented source: >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md#operations staff_access: >- Platform controls customer-workspace staff grants, standing access and emergency entry separately from HQ authority. A customer administrator policy never grants the staff-only electronic-check clearing key. provenance: observed source: >- services-accounting:aws/accounting.service.ts; rhythm-v2-docs:specs/platform/security/design/workflows/WF-PFM-SEC-009-authorize-a-request-at-the-gateway.md evidence: - 'services-accounting:aws/accounting.service.ts' - 'services-accounting:modules/books/aws/api/*.routes.ts' - 'services-accounting:modules/products/aws/api/*.routes.ts' - 'services-accounting:modules/transactions/aws/api/*.routes.ts' - 'services-accounting:modules/batches/aws/api/*.routes.ts' - 'services-accounting:modules/reconciliation/aws/api/*.routes.ts' - 'services-accounting:modules/fiscal-close/aws/api/*.routes.ts' - 'services-accounting:modules/maintenance/aws/api/scheduling.routes.ts' - >- services-accounting:modules/maintenance/services/scheduled-work/accounting-scheduled-work.ts - >- rhythm-v2-docs:specs/accounting/batches/design/contracts/SVC-ACC-BAT-batches.md - 'rhythm-v2-docs:specs/accounting/books/design/contracts/SVC-ACC-BKS-books.md' - >- rhythm-v2-docs:specs/accounting/books/design/contracts/SVC-ACC-BKS-maintenance.md - >- rhythm-v2-docs:specs/accounting/close/design/contracts/SVC-ACC-CLS-fiscal-close.md - >- rhythm-v2-docs:specs/accounting/products/design/contracts/SVC-ACC-PRD-products.md - >- rhythm-v2-docs:specs/accounting/reconciliation/design/contracts/SVC-ACC-REC-reconciliation.md - >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-007-know-what-i-may-do-in-a-workspace.md - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-008-invite-people-and-follow-their-invitations.md - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-009-maintain-people-s-console-accounts.md - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-010-give-and-take-away-roles-at-the-right-scope.md - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-012-define-a-customer-s-own-roles-and-policies.md - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-015-decide-every-request-against-the-caller-s-grants.md - >- rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-017-let-rhythm-staff-into-a-customer-s-workspace-only-by-consent.md - >- rhythm-v2-docs:specs/platform/security/design/decisions/ADR-PFM-SEC-007-authority-comes-only-from-assignments-signed-per-request-and.md - >- rhythm-v2-docs:specs/platform/security/design/decisions/ADR-PFM-SEC-008-sign-in-provider-calls-follow-the-commit-removals-are-queued-work.md - >- rhythm-v2-docs:specs/platform/security/design/decisions/ADR-PFM-SEC-009-staff-enter-customer-work-only-through-recorded-grants.md - >- rhythm-v2-docs:specs/platform/security/design/decisions/ADR-PFM-SEC-010-shared-definitions-are-reconciled-from-each-release-and-change.md - >- rhythm-v2-docs:specs/platform/security/design/decisions/ADR-PFM-SEC-012-no-operation-of-this-module-is-published-to-submissions.md - >- rhythm-v2-docs:specs/platform/security/design/decisions/ADR-PFM-SEC-013-replacements-carry-the-complete-record-and-the-version-read.md - >- rhythm-v2-docs:specs/platform/security/design/decisions/ADR-PFM-SEC-015-derived-assignments-are-contact-keyed-source-owned-and-expire-as.md - >- rhythm-v2-docs:specs/platform/security/design/workflows/WF-PFM-SEC-007-suspend-reinstate-revoke-or-delete-a-membership.md - >- rhythm-v2-docs:specs/platform/security/design/workflows/WF-PFM-SEC-008-flush-the-gateway-s-cached-decisions.md - >- rhythm-v2-docs:specs/platform/security/design/workflows/WF-PFM-SEC-009-authorize-a-request-at-the-gateway.md - >- rhythm-v2-docs:specs/platform/security/design/workflows/WF-PFM-SEC-010-reconcile-derived-role-assignments.md - >- rhythm-v2-docs:specs/platform/security/design/workflows/WF-PFM-SEC-012-reconcile-shared-definitions-founding-staff-and-principals-on.md - >- rhythm-v2-docs:specs/platform/security/design/workflows/WF-PFM-SEC-013-onboard-a-workspace-s-portal-sign-in-pool.md - >- rhythm-v2-docs:specs/platform/security/design/workflows/WF-PFM-SEC-015-link-a-portal-member-to-a-contact.md - 'react-console:lib/authz/backend-aliases.ts' - 'react-console:components/accounting/reconciliation' - 'react-console:components/accounting/close' section_sources: - section: Authorization Boundary provenance: observed source: >- services-accounting:modules/transactions/aws/api/stripe.routes.ts; modules/transactions/aws/api/payments.routes.ts; rhythm-v2-docs:specs/platform/security/design/workflows/WF-PFM-SEC-009-authorize-a-request-at-the-gateway.md - section: Roles and Role Entitlement Matrix provenance: observed source: >- services-accounting:aws/accounting.service.ts:ReconciliationBuiltInPolicies; rhythm-v2-docs:specs/platform/security/planning/capabilities/CAP-PFM-SEC-013-ship-rhythm-s-built-in-roles-and-policies-with-each-release.md - section: Protected Actions provenance: documented source: >- rhythm-v2-docs:specs/accounting/transactions/design/contracts/SVC-ACC-TRX-transactions.md; specs/accounting/reconciliation/design/contracts/SVC-ACC-REC-reconciliation.md; specs/accounting/close/design/contracts/SVC-ACC-CLS-fiscal-close.md; specs/accounting/books/design/contracts/SVC-ACC-BKS-maintenance.md - section: Guards Distinguished From Permissions provenance: documented source: >- rhythm-v2-docs:specs/platform/security/design/decisions/ADR-PFM-SEC-007-authority-comes-only-from-assignments-signed-per-request-and.md; specs/accounting/close/FINDINGS.md#OQ-ACC-CLS-001 - section: What People See When Refused provenance: documented source: >- rhythm-v2-docs:specs/accounting/batches/planning/capabilities/CAP-ACC-BAT-002-find-batches-and-see-what-they-hold.md; specs/accounting/transactions/planning/capabilities/CAP-ACC-TRX-016-find-transactions-and-see-what-can-be-done-next.md --- # Accounting Authorization Model ## Authorization Boundary Protected customer requests need established workspace authority and the operation’s declared permissions. Platform evaluates the caller and passes bounded signed authority to the receiving service. Accounting applies the operation and record checks at that boundary. Opening the application does not independently grant every financial action. Health operations are public. The retained Stripe webhook also has a public route and requires its own processor validation; public routing supplies no customer role authority. Registered service callers use their separately restricted financial interfaces, while scheduled and lifecycle workers use machine execution. The system operation for marking electronic-check clearing requires a staff-only permission that generated customer tiers exclude. ## Scopes The selected workspace bounds customer grants and owned records. A business unit supplies the books, currency and eligible references for financial work. That ownership boundary does not establish a business-unit role grant: the examined close and reconciliation permissions apply across the workspace. Record checks protect identifiers, versions, locks and lifecycle eligibility after permission evaluation. Platform supports scoped role assignments, but the presence of those facilities does not prove that every Accounting operation evaluates a narrower scope. ## Roles The five profiles below describe Accounting policy entitlements within customer-composed roles. Read Only, User and Administrator are generated application policy tiers. The generated user profile includes read powers, and the administrator profile includes eligible lower-tier powers. These profiles describe the keys used by this area’s artifacts; Billing also publishes keys under the same application prefix and retains its own specification home. Reconciliation Preparer and Reconciliation Approver are named policy profiles that a customer attaches to roles. The approver policy includes preparation powers as well as approval powers, so assigning the policy alone does not establish independent review. The financial command still evaluates its second-person guard. Declaring a policy assigns it to nobody. Customer role assignment, delegation checks and changes to held authority belong to Platform Security. ## Permission Catalogue Each key below has its declared tier, operation references, surfaces, further rule guards and provenance in the structured catalogue. A published family key can have no operation when the service publishes it without using it in a route. Query permissions protect Platform datasets separately from direct record reads. Console aliases resolve to backend keys and do not create additional service authority. | Permission | Purpose | |---|---| | `accounting.accounting-projects.bulk` | Perform bulk administration of accounting projects. | | `accounting.accounting-projects.create` | Create accounting projects. | | `accounting.accounting-projects.delete` | Remove accounting projects. | | `accounting.accounting-projects.read` | Read accounting projects. | | `accounting.accounting-projects.update` | Change accounting projects. | | `accounting.application.access` | Open the Accounting application. | | `accounting.ar-aging.read` | Read receivables aging. | | `accounting.ar-snapshot-items.query` | Query ar snapshot items. | | `accounting.ar-snapshot-totals.query` | Query ar snapshot totals. | | `accounting.bank-accounts.bulk` | Perform bulk administration of bank accounts. | | `accounting.bank-accounts.create` | Create bank accounts. | | `accounting.bank-accounts.delete` | Remove bank accounts. | | `accounting.bank-accounts.read` | Read bank accounts. | | `accounting.bank-accounts.update` | Change bank accounts. | | `accounting.batch-assignment-settings.delete` | Remove batch assignment settings. | | `accounting.batch-assignment-settings.read` | Read batch assignment settings. | | `accounting.batch-assignment-settings.update` | Change batch assignment settings. | | `accounting.batch-postings.post` | Post batch posting work. | | `accounting.batch-postings.preview` | Preview batch posting work. | | `accounting.batch-postings.unpost` | Unpost batch posting work. | | `accounting.batches.create` | Create batches. | | `accounting.batches.delete` | Remove batches. | | `accounting.batches.query` | Query batches. | | `accounting.batches.read` | Read batches. | | `accounting.batches.update` | Change batches. | | `accounting.business-units.bulk` | Perform bulk administration of business units. | | `accounting.business-units.create` | Create business units. | | `accounting.business-units.delete` | Remove business units. | | `accounting.business-units.query` | Query business units. | | `accounting.business-units.read` | Read business units. | | `accounting.business-units.update` | Change business units. | | `accounting.credit-applications.create` | Create credit applications. | | `accounting.credit-applications.query` | Query credit applications. | | `accounting.credit-applications.read` | Read credit applications. | | `accounting.credit-applications.update` | Change credit applications. | | `accounting.credit-memos.create` | Create credit memos. | | `accounting.credit-memos.query` | Query credit memos. | | `accounting.credit-memos.read` | Read credit memos. | | `accounting.credit-memos.update` | Change credit memos. | | `accounting.credits.create` | Create credits. | | `accounting.credits.query` | Query credits. | | `accounting.credits.read` | Read credits. | | `accounting.credits.update` | Change credits. | | `accounting.customer-terms.manage` | Maintain customer collection terms. | | `accounting.customer-terms.read` | Read customer collection terms. | | `accounting.debit-memos.create` | Create debit memos. | | `accounting.debit-memos.query` | Query debit memos. | | `accounting.debit-memos.read` | Read debit memos. | | `accounting.debit-memos.update` | Change debit memos. | | `accounting.departments.bulk` | Perform bulk administration of departments. | | `accounting.departments.create` | Create departments. | | `accounting.departments.delete` | Remove departments. | | `accounting.departments.read` | Read departments. | | `accounting.departments.update` | Change departments. | | `accounting.disputes.create` | Create disputes. | | `accounting.disputes.read` | Read disputes. | | `accounting.disputes.update` | Change disputes. | | `accounting.document-templates.bulk` | Perform bulk administration of document templates. | | `accounting.document-templates.create` | Create document templates. | | `accounting.document-templates.delete` | Remove document templates. | | `accounting.document-templates.read` | Read document templates. | | `accounting.document-templates.update` | Change document templates. | | `accounting.exchange-rates.bulk` | Perform bulk administration of exchange rates. | | `accounting.exchange-rates.create` | Create exchange rates. | | `accounting.exchange-rates.delete` | Remove exchange rates. | | `accounting.exchange-rates.read` | Read exchange rates. | | `accounting.exchange-rates.update` | Change exchange rates. | | `accounting.expected-remittances.query` | Query expected remittances. | | `accounting.fiscal-periods.close` | Close fiscal periods. | | `accounting.fiscal-periods.read` | Read fiscal periods. | | `accounting.fiscal-periods.reopen` | Reopen fiscal periods. | | `accounting.fiscal-years.bulk` | Perform bulk administration of fiscal years. | | `accounting.fiscal-years.create` | Create fiscal years. | | `accounting.fiscal-years.delete` | Remove fiscal years. | | `accounting.fiscal-years.read` | Read fiscal years. | | `accounting.fiscal-years.update` | Change fiscal years. | | `accounting.gl-accounts.bulk` | Perform bulk administration of general ledger accounts. | | `accounting.gl-accounts.create` | Create general ledger accounts. | | `accounting.gl-accounts.delete` | Remove general ledger accounts. | | `accounting.gl-accounts.read` | Read general ledger accounts. | | `accounting.gl-accounts.update` | Change general ledger accounts. | | `accounting.invoices.adjust` | Adjust invoices. | | `accounting.invoices.create` | Create invoices. | | `accounting.invoices.delete` | Remove invoices. | | `accounting.invoices.email` | Send an invoice communication to its selected recipients. | | `accounting.invoices.query` | Query invoices. | | `accounting.invoices.read` | Read invoices. | | `accounting.invoices.update` | Change invoices. | | `accounting.invoices.void` | Void invoices. | | `accounting.merchant-accounts.bulk` | Perform bulk administration of merchant accounts. | | `accounting.merchant-accounts.create` | Create merchant accounts. | | `accounting.merchant-accounts.delete` | Remove merchant accounts. | | `accounting.merchant-accounts.read` | Read merchant accounts. | | `accounting.merchant-accounts.update` | Change merchant accounts. | | `accounting.payment-element.create` | Create a processor setup intent for payment-method entry. | | `accounting.payment-element.read` | Read processor payment-entry information. | | `accounting.payment-methods.bulk` | Perform bulk administration of payment methods. | | `accounting.payment-methods.create` | Create payment methods. | | `accounting.payment-methods.delete` | Remove payment methods. | | `accounting.payment-methods.read` | Read payment methods. | | `accounting.payment-methods.update` | Change payment methods. | | `accounting.payment-terms.bulk` | Perform bulk administration of payment terms. | | `accounting.payment-terms.create` | Create payment terms. | | `accounting.payment-terms.delete` | Remove payment terms. | | `accounting.payment-terms.read` | Read payment terms. | | `accounting.payment-terms.update` | Change payment terms. | | `accounting.payments.create` | Create payments. | | `accounting.payments.query` | Query payments. | | `accounting.payments.read` | Read payments. | | `accounting.payments.reverse` | Reverse payments. | | `accounting.payments.settle` | Let Rhythm staff mark an eligible electronic-check receipt as cleared. | | `accounting.payments.update` | Change payments. | | `accounting.payments.void` | Void payments. | | `accounting.payouts.create` | Create payouts. | | `accounting.payouts.delete` | Remove payouts. | | `accounting.payouts.read` | Read payouts. | | `accounting.payouts.update` | Change payouts. | | `accounting.payouts.verify` | Verify payouts. | | `accounting.product-accounting.delete` | Remove product accounting setups. | | `accounting.product-accounting.read` | Read product accounting setups. | | `accounting.product-accounting.update` | Change product accounting setups. | | `accounting.products.create` | Create products. | | `accounting.products.delete` | Remove products. | | `accounting.products.read` | Read products. | | `accounting.products.update` | Change products. | | `accounting.reconciliation-batches.create` | Create reconciliation batches. | | `accounting.reconciliation-batches.delete` | Remove reconciliation batches. | | `accounting.reconciliation-batches.finalize` | Finalize reconciliation batches. | | `accounting.reconciliation-batches.read` | Read reconciliation batches. | | `accounting.reconciliation-batches.reverse` | Reverse reconciliation batches. | | `accounting.reconciliation-batches.update` | Change reconciliation batches. | | `accounting.reconciliation-exceptions.accept` | Accept reconciliation exceptions. | | `accounting.reconciliation-exceptions.read` | Read reconciliation exceptions. | | `accounting.reconciliation-exceptions.update` | Change reconciliation exceptions. | | `accounting.recurring-batches.create` | Create recurring batches. | | `accounting.recurring-batches.delete` | Remove recurring batches. | | `accounting.recurring-batches.read` | Read recurring batches. | | `accounting.recurring-batches.update` | Change recurring batches. | | `accounting.recurring-billing-runs.read` | Read recurring billing runs. | | `accounting.refunds.approve` | Approve refunds. | | `accounting.refunds.create` | Create refunds. | | `accounting.refunds.execute` | Execute refunds. | | `accounting.refunds.query` | Query refunds. | | `accounting.refunds.read` | Read refunds. | | `accounting.remittances.create` | Create remittances. | | `accounting.remittances.read` | Read remittances. | | `accounting.remittances.void` | Void remittances. | | `accounting.revenue-schedule-entries.query` | Query revenue schedule entries. | | `accounting.reversals.create` | Create reversals. | | `accounting.reversals.preview` | Preview reversals. | | `accounting.reversals.read` | Read reversals. | | `accounting.settings.bulk` | Perform bulk administration of settings. | | `accounting.settings.create` | Create settings. | | `accounting.settings.delete` | Remove settings. | | `accounting.settings.read` | Read settings. | | `accounting.settings.update` | Change settings. | | `accounting.settlement-items.read` | Read settlement items. | | `accounting.settlement-items.resolve` | Resolve settlement items. | | `accounting.settlements.create` | Create settlements. | | `accounting.settlements.read` | Read settlements. | | `accounting.stripe-settings.read` | Read legacy Stripe configuration. | | `accounting.stripe-settings.update` | Change legacy Stripe configuration. | | `accounting.subledger-entries.read` | Read subledger entries. | | `accounting.subledger-entry-lines.query` | Query subledger entry lines. | | `accounting.tax-classes.bulk` | Perform bulk administration of tax classes. | | `accounting.tax-classes.create` | Create tax classes. | | `accounting.tax-classes.delete` | Remove tax classes. | | `accounting.tax-classes.read` | Read tax classes. | | `accounting.tax-classes.update` | Change tax classes. | | `accounting.tax-zones.bulk` | Perform bulk administration of tax zones. | | `accounting.tax-zones.create` | Create tax zones. | | `accounting.tax-zones.delete` | Remove tax zones. | | `accounting.tax-zones.read` | Read tax zones. | | `accounting.tax-zones.update` | Change tax zones. | | `accounting.tax.calculate` | Calculate tax on priced lines. | | `accounting.transactions.query` | Query transactions. | | `accounting.write-offs.create` | Create write offs. | | `accounting.write-offs.query` | Query write offs. | | `accounting.write-offs.read` | Read write offs. | | `accounting.write-offs.update` | Change write offs. | The structured catalogue also retains the service contracts’ literal combined requirements and descriptions of public, internal or machine access. Those rows are explicitly marked as operation requirements. They are not assignable permission keys and do not appear in role grants. Their constituent keys and operation references preserve the all-of, any-of and action-dependent boundaries without changing existing contracts. ## Role Entitlement Matrix The matrix shows the area’s exact permission keys granted by each policy profile. A dash means that this policy does not grant the key; it does not override another held policy. The staff-only clearing key is absent from every customer profile. | Permission | Read Only | User | Administrator | Preparer | Approver | |---|---|---|---|---|---| | `accounting.accounting-projects.bulk` | — | — | Granted | — | — | | `accounting.accounting-projects.create` | — | — | Granted | — | — | | `accounting.accounting-projects.delete` | — | — | Granted | — | — | | `accounting.accounting-projects.read` | Granted | Granted | Granted | — | — | | `accounting.accounting-projects.update` | — | — | Granted | — | — | | `accounting.application.access` | Granted | Granted | Granted | Granted | Granted | | `accounting.ar-aging.read` | Granted | Granted | Granted | — | — | | `accounting.ar-snapshot-items.query` | Granted | Granted | Granted | — | — | | `accounting.ar-snapshot-totals.query` | Granted | Granted | Granted | — | — | | `accounting.bank-accounts.bulk` | — | — | Granted | — | — | | `accounting.bank-accounts.create` | — | — | Granted | — | — | | `accounting.bank-accounts.delete` | — | — | Granted | — | — | | `accounting.bank-accounts.read` | Granted | Granted | Granted | — | — | | `accounting.bank-accounts.update` | — | — | Granted | — | — | | `accounting.batch-assignment-settings.delete` | — | — | Granted | — | — | | `accounting.batch-assignment-settings.read` | Granted | Granted | Granted | — | — | | `accounting.batch-assignment-settings.update` | — | — | Granted | — | — | | `accounting.batch-postings.post` | — | Granted | Granted | — | — | | `accounting.batch-postings.preview` | Granted | Granted | Granted | — | — | | `accounting.batch-postings.unpost` | — | — | Granted | — | — | | `accounting.batches.create` | — | Granted | Granted | — | — | | `accounting.batches.delete` | — | Granted | Granted | — | — | | `accounting.batches.query` | Granted | Granted | Granted | — | — | | `accounting.batches.read` | Granted | Granted | Granted | — | — | | `accounting.batches.update` | — | Granted | Granted | — | — | | `accounting.business-units.bulk` | — | — | Granted | — | — | | `accounting.business-units.create` | — | — | Granted | — | — | | `accounting.business-units.delete` | — | — | Granted | — | — | | `accounting.business-units.query` | Granted | Granted | Granted | — | — | | `accounting.business-units.read` | Granted | Granted | Granted | — | — | | `accounting.business-units.update` | — | — | Granted | — | — | | `accounting.credit-applications.create` | — | Granted | Granted | — | — | | `accounting.credit-applications.query` | Granted | Granted | Granted | — | — | | `accounting.credit-applications.read` | Granted | Granted | Granted | — | — | | `accounting.credit-applications.update` | — | Granted | Granted | — | — | | `accounting.credit-memos.create` | — | Granted | Granted | — | — | | `accounting.credit-memos.query` | Granted | Granted | Granted | — | — | | `accounting.credit-memos.read` | Granted | Granted | Granted | — | — | | `accounting.credit-memos.update` | — | Granted | Granted | — | — | | `accounting.credits.create` | — | Granted | Granted | — | — | | `accounting.credits.query` | Granted | Granted | Granted | — | — | | `accounting.credits.read` | Granted | Granted | Granted | — | — | | `accounting.credits.update` | — | Granted | Granted | — | — | | `accounting.customer-terms.manage` | — | Granted | Granted | — | — | | `accounting.customer-terms.read` | Granted | Granted | Granted | — | — | | `accounting.debit-memos.create` | — | Granted | Granted | — | — | | `accounting.debit-memos.query` | Granted | Granted | Granted | — | — | | `accounting.debit-memos.read` | Granted | Granted | Granted | — | — | | `accounting.debit-memos.update` | — | Granted | Granted | — | — | | `accounting.departments.bulk` | — | — | Granted | — | — | | `accounting.departments.create` | — | — | Granted | — | — | | `accounting.departments.delete` | — | — | Granted | — | — | | `accounting.departments.read` | Granted | Granted | Granted | — | — | | `accounting.departments.update` | — | — | Granted | — | — | | `accounting.disputes.create` | — | Granted | Granted | — | — | | `accounting.disputes.read` | Granted | Granted | Granted | — | — | | `accounting.disputes.update` | — | Granted | Granted | — | — | | `accounting.document-templates.bulk` | — | — | Granted | — | — | | `accounting.document-templates.create` | — | — | Granted | — | — | | `accounting.document-templates.delete` | — | — | Granted | — | — | | `accounting.document-templates.read` | Granted | Granted | Granted | — | — | | `accounting.document-templates.update` | — | — | Granted | — | — | | `accounting.exchange-rates.bulk` | — | — | Granted | — | — | | `accounting.exchange-rates.create` | — | — | Granted | — | — | | `accounting.exchange-rates.delete` | — | — | Granted | — | — | | `accounting.exchange-rates.read` | Granted | Granted | Granted | — | — | | `accounting.exchange-rates.update` | — | — | Granted | — | — | | `accounting.expected-remittances.query` | Granted | Granted | Granted | — | — | | `accounting.fiscal-periods.close` | — | — | Granted | — | — | | `accounting.fiscal-periods.read` | Granted | Granted | Granted | — | — | | `accounting.fiscal-periods.reopen` | — | — | Granted | — | — | | `accounting.fiscal-years.bulk` | — | — | Granted | — | — | | `accounting.fiscal-years.create` | — | — | Granted | — | — | | `accounting.fiscal-years.delete` | — | — | Granted | — | — | | `accounting.fiscal-years.read` | Granted | Granted | Granted | — | — | | `accounting.fiscal-years.update` | — | — | Granted | — | — | | `accounting.gl-accounts.bulk` | — | — | Granted | — | — | | `accounting.gl-accounts.create` | — | — | Granted | — | — | | `accounting.gl-accounts.delete` | — | — | Granted | — | — | | `accounting.gl-accounts.read` | Granted | Granted | Granted | — | — | | `accounting.gl-accounts.update` | — | — | Granted | — | — | | `accounting.invoices.adjust` | — | Granted | Granted | — | — | | `accounting.invoices.create` | — | Granted | Granted | — | — | | `accounting.invoices.delete` | — | Granted | Granted | — | — | | `accounting.invoices.email` | — | Granted | Granted | — | — | | `accounting.invoices.query` | Granted | Granted | Granted | — | — | | `accounting.invoices.read` | Granted | Granted | Granted | — | — | | `accounting.invoices.update` | — | Granted | Granted | — | — | | `accounting.invoices.void` | — | Granted | Granted | — | — | | `accounting.merchant-accounts.bulk` | — | — | Granted | — | — | | `accounting.merchant-accounts.create` | — | — | Granted | — | — | | `accounting.merchant-accounts.delete` | — | — | Granted | — | — | | `accounting.merchant-accounts.read` | Granted | Granted | Granted | — | — | | `accounting.merchant-accounts.update` | — | — | Granted | — | — | | `accounting.payment-element.create` | — | Granted | Granted | — | — | | `accounting.payment-element.read` | Granted | Granted | Granted | — | — | | `accounting.payment-methods.bulk` | — | — | Granted | — | — | | `accounting.payment-methods.create` | — | — | Granted | — | — | | `accounting.payment-methods.delete` | — | — | Granted | — | — | | `accounting.payment-methods.read` | Granted | Granted | Granted | — | — | | `accounting.payment-methods.update` | — | — | Granted | — | — | | `accounting.payment-terms.bulk` | — | — | Granted | — | — | | `accounting.payment-terms.create` | — | — | Granted | — | — | | `accounting.payment-terms.delete` | — | — | Granted | — | — | | `accounting.payment-terms.read` | Granted | Granted | Granted | — | — | | `accounting.payment-terms.update` | — | — | Granted | — | — | | `accounting.payments.create` | — | Granted | Granted | — | — | | `accounting.payments.query` | Granted | Granted | Granted | — | — | | `accounting.payments.read` | Granted | Granted | Granted | — | — | | `accounting.payments.reverse` | — | Granted | Granted | — | — | | `accounting.payments.settle` | — | — | — | — | — | | `accounting.payments.update` | — | Granted | Granted | — | — | | `accounting.payments.void` | — | Granted | Granted | — | — | | `accounting.payouts.create` | — | Granted | Granted | Granted | Granted | | `accounting.payouts.delete` | — | Granted | Granted | Granted | Granted | | `accounting.payouts.read` | Granted | Granted | Granted | Granted | Granted | | `accounting.payouts.update` | — | Granted | Granted | Granted | Granted | | `accounting.payouts.verify` | — | Granted | Granted | Granted | Granted | | `accounting.product-accounting.delete` | — | — | Granted | — | — | | `accounting.product-accounting.read` | Granted | Granted | Granted | — | — | | `accounting.product-accounting.update` | — | — | Granted | — | — | | `accounting.products.create` | — | — | Granted | — | — | | `accounting.products.delete` | — | — | Granted | — | — | | `accounting.products.read` | Granted | Granted | Granted | — | — | | `accounting.products.update` | — | — | Granted | — | — | | `accounting.reconciliation-batches.create` | — | Granted | Granted | Granted | Granted | | `accounting.reconciliation-batches.delete` | — | Granted | Granted | Granted | Granted | | `accounting.reconciliation-batches.finalize` | — | — | Granted | — | Granted | | `accounting.reconciliation-batches.read` | Granted | Granted | Granted | Granted | Granted | | `accounting.reconciliation-batches.reverse` | — | — | Granted | — | Granted | | `accounting.reconciliation-batches.update` | — | Granted | Granted | Granted | Granted | | `accounting.reconciliation-exceptions.accept` | — | — | Granted | — | Granted | | `accounting.reconciliation-exceptions.read` | Granted | Granted | Granted | Granted | Granted | | `accounting.reconciliation-exceptions.update` | — | Granted | Granted | Granted | Granted | | `accounting.recurring-batches.create` | — | — | Granted | — | — | | `accounting.recurring-batches.delete` | — | — | Granted | — | — | | `accounting.recurring-batches.read` | Granted | Granted | Granted | — | — | | `accounting.recurring-batches.update` | — | — | Granted | — | — | | `accounting.recurring-billing-runs.read` | Granted | Granted | Granted | — | — | | `accounting.refunds.approve` | — | Granted | Granted | — | — | | `accounting.refunds.create` | — | Granted | Granted | — | — | | `accounting.refunds.execute` | — | Granted | Granted | — | — | | `accounting.refunds.query` | Granted | Granted | Granted | — | — | | `accounting.refunds.read` | Granted | Granted | Granted | — | — | | `accounting.remittances.create` | — | Granted | Granted | — | — | | `accounting.remittances.read` | Granted | Granted | Granted | — | — | | `accounting.remittances.void` | — | Granted | Granted | — | — | | `accounting.revenue-schedule-entries.query` | Granted | Granted | Granted | — | — | | `accounting.reversals.create` | — | Granted | Granted | — | — | | `accounting.reversals.preview` | Granted | Granted | Granted | — | — | | `accounting.reversals.read` | Granted | Granted | Granted | — | — | | `accounting.settings.bulk` | — | — | Granted | — | — | | `accounting.settings.create` | — | — | Granted | — | — | | `accounting.settings.delete` | — | — | Granted | — | — | | `accounting.settings.read` | Granted | Granted | Granted | — | — | | `accounting.settings.update` | — | — | Granted | — | — | | `accounting.settlement-items.read` | Granted | Granted | Granted | Granted | Granted | | `accounting.settlement-items.resolve` | — | — | Granted | — | Granted | | `accounting.settlements.create` | — | Granted | Granted | — | — | | `accounting.settlements.read` | Granted | Granted | Granted | — | — | | `accounting.stripe-settings.read` | Granted | Granted | Granted | — | — | | `accounting.stripe-settings.update` | — | — | Granted | — | — | | `accounting.subledger-entries.read` | Granted | Granted | Granted | — | — | | `accounting.subledger-entry-lines.query` | Granted | Granted | Granted | — | — | | `accounting.tax-classes.bulk` | — | — | Granted | — | — | | `accounting.tax-classes.create` | — | — | Granted | — | — | | `accounting.tax-classes.delete` | — | — | Granted | — | — | | `accounting.tax-classes.read` | Granted | Granted | Granted | — | — | | `accounting.tax-classes.update` | — | — | Granted | — | — | | `accounting.tax-zones.bulk` | — | — | Granted | — | — | | `accounting.tax-zones.create` | — | — | Granted | — | — | | `accounting.tax-zones.delete` | — | — | Granted | — | — | | `accounting.tax-zones.read` | Granted | Granted | Granted | — | — | | `accounting.tax-zones.update` | — | — | Granted | — | — | | `accounting.tax.calculate` | Granted | Granted | Granted | — | — | | `accounting.transactions.query` | Granted | Granted | Granted | — | — | | `accounting.write-offs.create` | — | Granted | Granted | — | — | | `accounting.write-offs.query` | Granted | Granted | Granted | — | — | | `accounting.write-offs.read` | Granted | Granted | Granted | — | — | | `accounting.write-offs.update` | — | Granted | Granted | — | — | ## Protected Actions The catalogue’s rule references retain record and financial guards in their capability homes. Reconciliation finalization and exception acceptance include independent-person conditions. Refund approval also checks the requester when approval is enabled. Close and reopen have separate administrator-tier permissions and retain period eligibility checks. An administrator grant does not bypass these conditions. Settlement creation requires settlement, payment and credit-application creation permissions together. Settlement reading requires its own read permission and either payment or credit-application read permission. Remittance commands require the matching payment permissions, while expected-remittance lookup additionally needs invoice read. Schedule-history reading first needs application access and then the permission for the schedule’s owning record. Action-dispatch routes evaluate the selected action beyond the read permission used to enter the handler. Staff electronic-check clearing is a separate system boundary. Ordinary customer administration supplies neither staff identity nor its staff-only key. Platform governs staff entry into customer workspaces through recorded grants, standing access and emergency entry; HQ authority remains distinct from authority to perform customer financial work. ## Guards Distinguished From Permissions A permission answers whether the caller may attempt a class of action. A guard answers whether the selected record and circumstances permit it now. Workspace ownership, matching financial references, record versions, locks, available money, period standing and independent-person requirements remain guards. Business-unit selection is accounting context rather than an implicit access grant. Platform’s planning and design describe a sixty-second gateway decision cache and thirty further seconds of signed-context validity. Changed assignments therefore do not promise immediate cutoff for previously issued authority. Accounting does not introduce a separate role cache or claim a stronger revocation bound. A durable close job acts with system authority after checked submission; whether withdrawing the requester’s grant should stop that accepted job remains an open Close decision. ## What People See When Refused A signed-in person without required screen access receives an access refusal rather than an empty financial list. Available actions depend on authority and financial eligibility: some screens omit unauthorized actions, while others disable them with an explanation. A visible or reachable form does not establish permission to save; the service still checks the command. Record ownership prevents a caller from using another workspace’s identifier as access, and foreign records read as absent where the capability specifies that boundary. Command refusals give a reason and, for the financial interfaces that define one, a stable refusal code. Version conflicts ask the person to reconcile newer work. Processor uncertainty remains an unresolved financial outcome that must be followed through recovery rather than treated as a permission failure.