Role Creep in a Shared Services Center
A company runs a shared services center where 35 AP clerks process vendor bills for four subsidiaries. Each clerk currently holds a single custom role that grants Full permissions on Vendor Bill, Vendor, and Journal Entry across all subsidiaries. An internal audit finds that clerks can post journals to any subsidiary and edit vendor master records, including bank details. Leadership wants clerks limited to their assigned subsidiary and blocked from editing vendor bank information, while still entering and approving bills. There are 35 clerks and 4 subsidiaries, and the company wants to avoid maintaining 140 roles.
1. Design a role and restriction approach that meets the audit findings without creating 140 roles.
Read the worked answer
Use one role plus data-level restriction, not role multiplication.
- Single custom role with the minimum permissions: Vendor Bill (Create/Edit/Approve), Vendor (View only), Journal Entry (View or none). Remove Full on Journal Entry entirely unless truly required.
- Subsidiary restriction on the role: use the role's Subsidiaries restriction (or a subsidiary-based restriction) so a clerk only sees/transacts in their assigned subsidiary. Assign the subsidiary per employee via the role's restriction or via a subsidiary restriction tied to the user's assignment.
- Vendor bank details: restrict editing at the field level. Make the bank detail fields read-only on the Vendor form for this role (custom form per role, or field-level restriction), and route bank changes through a separate approval process.
This yields 1 role, 4 data scopes, and field-level protection - no 140 roles.
2. A clerk reports they can still see vendors from other subsidiaries in a global vendor search. What is the likely cause and the correct fix?
Read the worked answer
Likely cause: the role's subsidiary restriction applies to transactions, not necessarily to the Vendor record's visibility, or the clerk has a second role (e.g., a default or global role) that grants broader access. Also, if the Vendor record is not subsidiary-restricted, global search may surface it.
Diagnose in order:
- Check the user's assigned roles - a lingering second role defeats the restriction.
- Confirm the restriction is set on the role and that the Vendor record supports subsidiary restriction.
- If vendors are shared across subsidiaries by design, restrict editing (field-level) rather than visibility, and accept view-only global search.
Fix by removing the extra role and, if needed, applying a subsidiary restriction to the Vendor entity. Do not create per-subsidiary roles to patch this.