Finance — Permissions
Product version: 1.0.0+1
Last updated: 2026-10-07
Audience: Tenant Owners, role administrators
Shell access
The Finance rail is visible when the member has any finance section read access (account, journal, period, cash, expense, report, posting, e-invoice, or settlement read). finance:custody:read alone does not open Finance; it opens Custody → My cash. Billing permission alone does not open Finance.
Permission keys
| Permission | Allows |
|---|---|
finance:account:read / create / update |
Chart of accounts |
finance:journal:read / create |
Journals (create/post when granted) |
finance:period:read / close |
Fiscal years and periods; close/reopen |
finance:cash:read / transfer |
Cash books; transfers when granted |
finance:expense:read / create |
Expenses |
finance:report:read |
Financial reports |
finance:posting:read |
Automated posting status |
finance:einvoice:read / submit / configure |
National e-invoicing list; submit one or many invoices to the tax authority; e-invoicing settings and credentials |
finance:custody:read / settle |
The member's own custody cash and settlements; submit or cancel their own settlement |
finance:settlement:read / approve |
Every representative's custody cash and settlements; record a hand-over, confirm or cancel any settlement |
Backend APIs enforce these keys. Denied calls return a standard authorization error (no token leakage).
When a role holds both the own-cash key and the matching all-representatives key (custody:read with settlement:read, or custody:settle with settlement:approve), the all-representatives scope applies. With own-cash keys only, another representative's settlement answers as not found. Nobody can confirm a settlement for their own custody cash, whatever their role. See Cash settlements.
Built-in roles (finance)
| Role | Finance access |
|---|---|
| Owner / Administrator | Full finance:* category |
| Finance Manager | Full finance:* (not billing or sales write) |
| Accountant | All finance reads (including all cash settlements), journal:create, expense:create, einvoice:submit — no account create/update, period close, cash transfer, e-invoice configure, or settlement approval |
| Viewer | Finance reads only (including settlement:read, so every representative's cash and settlements) |
| Sales Representative | Own custody cash only (custody:read / custody:settle) |
| Inventory Manager / Warehouse Clerk / Sales Manager / Sales Clerk | None |
These are the starting permissions for a new organization. Only Owner is locked; the owner can change any other role. Assign under Team → Roles. See Built-in roles.
Related: Overview · Cash settlements · Roles & Permissions · Custom roles