--- id: CAP-ACC-BKS-016 title: Control access and safe changes to books configuration feature: FEAT-ACC-BKS-06 product_area: accounting module: books revision: 1 status: draft product_intent: confirmed implementation_evidence: observed supersedes: - CAP-ACC-SEC-002 - CAP-ACC-SEC-003 - CAP-ACC-SEC-005 source_sha: services-accounting: f47cb263875bbc0c5640fba7dae6785ec32695f8 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f intent_sources: - 'services-accounting:docs/milestones/ACCT-M1-books-and-invoices.md#D3' - 'services-accounting:docs/milestones/ACCT-M1-books-and-invoices.md#D11' - 'services-accounting:docs/milestones/plans/ACCT-M1-plan.md#D12' purpose: >- Finance staff read and maintain configuration under resource permissions and shared record safeguards. outcomes: - Read access permits inspection without authorizing configuration changes. - Workspace boundaries confine reads and changes. - Version checks prevent stale replacements. concepts: - CON-ACC-BKS-006 actors: - ACT-ACC-001 - ACT-ACC-002 - ACT-ACC-003 surfaces: - console - api preconditions: [] postconditions: [] permissions: - key: accounting.application.access where_checked: api scope: tenant - key: accounting.business-units.read where_checked: api scope: tenant - key: accounting.business-units.bulk where_checked: api scope: tenant - key: accounting.gl-accounts.bulk where_checked: api scope: tenant - key: accounting.bank-accounts.bulk where_checked: api scope: tenant - key: accounting.merchant-accounts.bulk where_checked: api scope: tenant - key: accounting.departments.bulk where_checked: api scope: tenant - key: accounting.accounting-projects.bulk where_checked: api scope: tenant - key: accounting.payment-terms.bulk where_checked: api scope: tenant - key: accounting.payment-methods.delete where_checked: api scope: tenant - key: accounting.payment-methods.bulk where_checked: api scope: tenant - key: accounting.tax-classes.bulk where_checked: api scope: tenant - key: accounting.tax-zones.bulk where_checked: api scope: tenant - key: accounting.exchange-rates.bulk where_checked: api scope: tenant - key: accounting.fiscal-years.bulk where_checked: api scope: tenant - key: accounting.document-templates.bulk where_checked: api scope: tenant - key: accounting.settings.create where_checked: api scope: tenant - key: accounting.settings.delete where_checked: api scope: tenant - key: accounting.settings.bulk where_checked: api scope: tenant rules: - id: BR-CAP-ACC-BKS-016-01 proved_by: [ATS-ACC-BKS-001-10, ATS-ACC-BKS-002-09, ATS-ACC-BKS-003-08, ATS-ACC-BKS-004-08, ATS-ACC-BKS-005-06, ATS-ACC-BKS-007-08, ATS-ACC-BKS-008-06, ATS-ACC-BKS-009-10, ATS-ACC-BKS-010-04, ATS-ACC-BKS-011-05, ATS-ACC-BKS-011-07, ATS-ACC-BKS-012-06, ATS-ACC-BKS-013-07, ATS-ACC-BKS-014-08, ATS-ACC-BKS-015-08, ATS-ACC-BKS-016-01, ATS-ACC-BKS-016-12, ATS-ACC-BKS-016-13, TST-ACC-BKS-043, TST-ACC-BKS-047, TST-ACC-BKS-051] statement: >- Each configuration kind has read permission from Read Only upward and administrator-level writes; default assignment is a unit update, rate filling a rate create and template duplication a template create. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-accounting:modules/books/tests/e2e/configuration-security.e2e.spec.js#is refused the create 403 permission_missing origin: 'services-accounting:docs/milestones/ACCT-M1-books-and-invoices.md#D3' - id: BR-CAP-ACC-BKS-016-02 proved_by: [ATS-ACC-BKS-016-02, ATS-ACC-BKS-016-14, TST-ACC-BKS-047, TST-ACC-BKS-048] statement: >- Configuration requests also require Accounting application access and licensing, while currencies, default purposes and processors require no additional resource permission. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-accounting:modules/books/tests/e2e/currencies.e2e.spec.js#answers 403 app_unlicensed in a tenant whose licence does not carry Accounting origin: none - id: BR-CAP-ACC-BKS-016-03 proved_by: [ATS-ACC-BKS-016-03, TST-ACC-BKS-043, TST-ACC-BKS-051] statement: >- Permission on one configuration kind grants no permission on another, so unit administration alone cannot create departments or read templates. kind: permission enforced_at: - api must_prove: true provenance: test source: >- services-accounting:modules/books/tests/e2e/accounting-dimensions-security.e2e.spec.js#is refused a department create 403 permission_missing, though it may update the unit origin: none - id: BR-CAP-ACC-BKS-016-04 proved_by: [ATS-ACC-BKS-016-04, ATS-ACC-BKS-019-09, TST-ACC-BKS-024, TST-ACC-BKS-046, TST-ACC-BKS-047, TST-ACC-BKS-063] statement: >- Workspace separation makes another workspace’s records absent from reads and lists, refuses cross-workspace references and is enforced for record rows by the database. kind: invariant enforced_at: - api - service - database must_prove: true provenance: test source: >- services-accounting:modules/books/tests/e2e/configuration-security.e2e.spec.js#answers 404 in tenant B to a read of tenant A’s business unit origin: none - id: BR-CAP-ACC-BKS-016-05 proved_by: [ATS-ACC-BKS-001-11, ATS-ACC-BKS-001-13, ATS-ACC-BKS-001-17, ATS-ACC-BKS-002-11, ATS-ACC-BKS-003-10, ATS-ACC-BKS-004-10, ATS-ACC-BKS-005-08, ATS-ACC-BKS-007-09, ATS-ACC-BKS-008-08, ATS-ACC-BKS-011-06, ATS-ACC-BKS-012-08, ATS-ACC-BKS-013-08, ATS-ACC-BKS-014-11, ATS-ACC-BKS-015-10, ATS-ACC-BKS-016-05, ATS-ACC-BKS-016-11, ATS-ACC-BKS-016-15, ATS-ACC-BKS-017-07, TST-ACC-BKS-025, TST-ACC-BKS-046, TST-ACC-BKS-058, TST-ACC-BKS-072] statement: >- Replacements require the read version, refuse stale versions, unknown properties or omitted required settings, clear ordinary omitted optional values and accept read-only properties from a retrieved record without writing them. kind: validation enforced_at: - api - service must_prove: true provenance: test source: >- services-accounting:modules/books/tests/e2e/payment-terms.e2e.spec.js#answers 400 naming is_active to a replacement that leaves it out origin: 'services-accounting:docs/milestones/plans/ACCT-M1-plan.md#D12' - id: BR-CAP-ACC-BKS-016-06 proved_by: [ATS-ACC-BKS-016-06, TST-ACC-BKS-050, TST-ACC-BKS-061] statement: Text inputs are trimmed and whitespace-only text is treated as missing. kind: validation enforced_at: - api - database must_prove: true provenance: test source: >- services-accounting:modules/books/tests/e2e/departments.e2e.spec.js#answers 400 naming name for a name of nothing but spaces origin: none - id: BR-CAP-ACC-BKS-016-07 proved_by: [ATS-ACC-BKS-016-07, TST-ACC-BKS-089, TST-ACC-BKS-102] statement: >- Full locks refuse updates and deletion, delete-only locks refuse deletion, GL-account updates can change lock settings only when the current lock permits updates, and configuration editors provide no lock controls. kind: policy enforced_at: - service must_prove: true provenance: observed source: >- services-accounting:modules/books/services/persistence/gl-accounts.ts:updateGlAccount origin: none - id: BR-CAP-ACC-BKS-016-08 proved_by: [ATS-ACC-BKS-016-08, TST-ACC-BKS-046] statement: >- Paged lists return items, a page count and a continuation cursor within their own size limits, and refuse malformed encoded offset cursors. kind: policy enforced_at: - api must_prove: true provenance: observed source: 'services-accounting:modules/books/aws/api/paging.ts:decodeCursor' origin: none - id: BR-CAP-ACC-BKS-016-09 proved_by: [ATS-ACC-BKS-016-09, TST-ACC-BKS-011, TST-ACC-BKS-012] statement: >- Console readers can load configuration lists and read-only editors without functioning write controls. kind: policy enforced_at: - console must_prove: true provenance: test source: >- react-console:acceptance/accounting/playwright/journeys/configuration/ACT-ACC-0013.spec.ts#ACT-ACC-0013 origin: 'services-accounting:docs/milestones/ACCT-M1-books-and-invoices.md#D11' - id: BR-CAP-ACC-BKS-016-10 proved_by: [] statement: >- Console constraints additionally require GL names, limit department and project codes to twenty characters, require whole term days and nonnegative priorities, fix account currency in editors and warn at the 2,000-record loading cap. kind: policy enforced_at: - console must_prove: false provenance: documented source: 'services-accounting:docs/milestones/plans/ACCT-M1-plan.md#D12' origin: 'services-accounting:docs/milestones/plans/ACCT-M1-plan.md#D12' - id: BR-CAP-ACC-BKS-016-11 proved_by: [] statement: >- Published bulk permissions, settings create and delete permissions and payment-method delete permission have no corresponding required action. kind: permission enforced_at: - api must_prove: false provenance: observed source: 'services-accounting:aws/accounting.service.ts:definePermissions' origin: none scenarios: - id: SC-CAP-ACC-BKS-016-01 given: A board reviewer has Read Only access. when: >- They inspect configuration screens and attempt record creation and correction. then: >- The lists are readable, writes are refused and stored configuration is retained. provenance: test source: >- react-console:acceptance/accounting/playwright/journeys/configuration/ACT-ACC-0013.spec.ts#ACT-ACC-0013 - id: SC-CAP-ACC-BKS-016-02 given: Two workspaces use the same business-unit identifier. when: 'Each performs its own unit reads, lists and deletion.' then: Neither workspace exposes or changes the other workspace’s unit. provenance: test source: >- react-console:acceptance/accounting/playwright/journeys/configuration/ACT-ACC-0040.spec.ts#ACT-ACC-0040 edge_cases: [] constraints: [] depends_on: [] related: - CAP-ACC-BKS-001 - CAP-ACC-BKS-005 - CAP-ACC-BKS-019 journeys: - JNY-ACC-BKS-005 open_questions: [] evidence: - >- Verified source file: react-console:acceptance/accounting/playwright/journeys/configuration/ACT-ACC-0013.spec.ts - >- Verified source file: react-console:acceptance/accounting/playwright/journeys/configuration/ACT-ACC-0040.spec.ts - 'Verified source file: services-accounting:aws/accounting.service.ts' - >- Verified source file: services-accounting:docs/milestones/ACCT-M1-books-and-invoices.md - >- Verified source file: services-accounting:docs/milestones/plans/ACCT-M1-plan.md - 'Verified source file: services-accounting:modules/books/aws/api/paging.ts' - >- Verified source file: services-accounting:modules/books/services/persistence/gl-accounts.ts - >- Verified source file: services-accounting:modules/books/tests/e2e/accounting-dimensions-security.e2e.spec.js - >- Verified source file: services-accounting:modules/books/tests/e2e/business-units.e2e.spec.js - >- Verified source file: services-accounting:modules/books/tests/e2e/configuration-security.e2e.spec.js - >- Verified source file: services-accounting:modules/books/tests/e2e/currencies.e2e.spec.js - >- Verified source file: services-accounting:modules/books/tests/e2e/departments.e2e.spec.js - >- Verified source file: services-accounting:modules/books/tests/e2e/document-templates-security.e2e.spec.js - >- Verified source file: services-accounting:modules/books/tests/e2e/payment-terms.e2e.spec.js - >- Verified source file: services-accounting:modules/books/tests/integration/db/accounting-dimensions.table.integration.spec.js - >- Verified source file: services-accounting:modules/books/tests/integration/db/configuration-records.table.integration.spec.js - >- Verified source file: services-accounting:modules/books/tests/integration/services/persistence/bank-accounts.integration.spec.js - >- Verified source file: services-accounting:modules/books/tests/integration/services/persistence/gl-accounts.integration.spec.js - >- Verified source file: services-accounting:modules/books/tests/integration/services/persistence/tax-zones.integration.spec.js controls: [TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-TEN-004, TC-DAT-001, TC-DAT-004, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-PI-001, TC-PI-003] exercised_by: [FAS-ACC-BKS-04-05, FAS-ACC-BKS-06-01, FAS-ACC-BKS-06-02, FAS-ACC-BKS-06-03, FAS-ACC-BKS-06-04] suites: [TST-ACC-BKS-011, TST-ACC-BKS-012, TST-ACC-BKS-024, TST-ACC-BKS-025, TST-ACC-BKS-043, TST-ACC-BKS-046, TST-ACC-BKS-047, TST-ACC-BKS-048, TST-ACC-BKS-050, TST-ACC-BKS-051, TST-ACC-BKS-058, TST-ACC-BKS-061, TST-ACC-BKS-063, TST-ACC-BKS-072, TST-ACC-BKS-089, TST-ACC-BKS-102] --- # Control access and safe changes to books configuration ## Purpose Finance staff read and maintain configuration under resource permissions and shared record safeguards. ## How It Works A caller first needs access to the Accounting application. Resource permissions then determine which configuration records they may read or change. Readers inspect lists and editors while administrators maintain configuration. An editor saves against the version it retrieved. A conflicting change requires staff to reload or reconcile their edits. Record locks and dependencies can produce separate refusals. The console also applies its own entry constraints, which staff using the API may not encounter. ## Relationships Platform evaluates access; each configuration capability uses these common record conventions.