Data Access, Security, and Approval Workflows
This domain tests who can see and change which financial data, and how journals are routed for approval before they post.
Security model
Roles carry duties and privileges; data access sets restrict which ledgers, ledger sets and balancing segment values a user can use. Access set types include All, Ledger, Ledger Set and Balancing Segment Value, and each grant is Read Only or Read/Write. A user needs both the role and the data access set; neither alone is sufficient.
Journal approval
Enable journal approval on the ledger, define approval limits per user or group, and let the approval workflow route submissions. Journals above the limit require approval before posting; rejection returns them for correction.
Worked example
An accountant must post to ledgers A and B but only company 100 values in each. Reasoning: create a ledger set containing A and B, then a data access set of type Ledger Set with Read/Write, restricted to balancing segment value 100. Assign both through the user's role. A Read Only grant would let the user query balances and journals but not create or post them, and an All access set would defeat the company restriction.
Traps
Confusing data access with role privileges; granting All access for convenience; assuming Read Only still permits posting; restricting segment values without checking that the balancing segment is the one being restricted.