Roles and Access

Who this is for. Everyone.

Which roles exist, what each one can reach, and where reaching a screen differs from being able to change what is on it. Use it to answer “should this person be able to do this”, and to tell a permission problem apart from a feature that is switched off.

Two gates, not one. A surface appears only when your role carries the permission and the tenant has the feature enabled, so two colleagues on the same tenant can meet different rails.

The roles

Read each row as a boundary. Covers is the part of the product the role works in, and What they own is the responsibility it carries there, which for some roles stops at reading the configuration.

Table 1. The roles used in this guide

There is no single “AP Manager” role. Where a reader would expect one, the product uses ProcureToPay Manager for work spanning AP Invoices and AP Helpdesk, and AP Helpdesk Manager where only the helpdesk function is involved. This guide uses the role names as they appear in the product.

One person can hold several roles. Where they do, the role name in the account menu becomes a switcher and they choose which one they are acting as; someone with a single role sees the name but no alternatives. Roles are listed in Administration > User Management, which also carries a separate Team Roles column. Team membership is tracked independently of the role.

What each role sees in the queue

Access is about more than which screens open. Two roles can open the same screen and see different rows.

This is why a manager and an analyst can report different counts for the same view. Before treating a discrepancy as a data problem, compare the two roles in Administration > User Management. An analyst is returned only their own tasks and tasks with no assignee, so a lower count from an analyst is the expected result.

Which screens each role can open

Available means the area is reachable for that role. Read only opens a screen without allowing any change. View only shows the data without the controls that change it. No access means the entry never appears.

Table 2. Access by area

A missing rail entry and a blocked screen are not the same thing. Some areas are hidden from the navigation rail for a role but still open if the reader follows a direct link, in read-only form. Agent Co-workers behaves this way for AP Helpdesk Analysts and Specialists: no rail entry, but the list of agents opens and shows their status. Treat the rail as the supported route, not as the boundary.

Super Admin is not enumerated. The role definitions grant permissions to the other roles explicitly; Super Admin reaches everything in the tenant, so the table lists only the roles where access differs. Available means the screen is reachable, not that every action on it is permitted.

Reaching a screen is not the same as changing what is on it. Agent Co-workers is the clearest case: a manager can open the Agent Co-workers list and see every agent and its state, but cannot open the setup wizard at all. Following a direct link to it returns them to the homepage.

Owning a setting and being able to change it are different things. A manager is accountable for what sender classification, email categories and processing rules say, and is the person to ask when they are wrong. Making the change is a Super Admin action: the Agent Co-worker wizard does not open for any role except Super Admin, and AP Intelligence does not open for the AP Helpdesk roles at all. Where this guide says a role owns a setting, it means the decision, not the permission.

This table describes the shipped defaults. Roles are configurable, so your tenant may grant more or less than shown. The authority is the role assignment in User Management.

If you are a Super Admin

You own everything an agent depends on but do not normally configure agents yourself.

• What Administration Covers

• Set Up Your AP Workcenter

If you are a ProcureToPay Manager or AP Helpdesk Manager

You own the rules and thresholds the agent works by, and answer for what it produces. Changing the Agent Co-worker configuration itself is a Super Admin action; no other role can view or edit it.

• Autonomy Models

• Agent Co-worker Overview

• Homepage Counters

If you are an AP Helpdesk Analyst

You work the exception queue and the mail behind it.

• Key Concepts

• Agents You Work Alongside

When access looks wrong

Table 3. Diagnosing access

Related information

• Your Role and Access

• User Management