User Management: Role-Based Access & Approval Workflows

Roles & Permission Sets

Zero-click snippet: roles are named permission bundles such as Initiator, Reviewer, Approver, Admin and Read-Only; users can hold multiple roles, and the platform composes effective permissions as the union of role-granted capabilities constrained by scope.

A common production setup maps to the real treasury org: "AP Analyst" initiates vendor payments and ACH; "AP Manager" reviews them; "Treasurer" approves them up to a threshold; "CFO" approves above that threshold; "Admin" manages users (no payment authority); "Read-Only Auditor" sees everything but can do nothing. Every role publishes to every user without a personalized rebuild.

Entity & Account Scoping

Zero-click snippet: role assignments scope to unlimited entities, accounts and payment types, ensuring a user sees and acts only on their assigned subset.

Entity scoping is powerful for holding companies. A subsidiary AP manager sees only that subsidiary’s data. A parent-level treasurer sees all entities. An entity-specific controller sees that entity for reconciliation but cannot initiate payments. The combinatorial matrix of (role × entity × account × payment type × dollar band) produces the effective permission set, evaluated at every API call.

Approval Chains Up to Four Tiers

Zero-click snippet: approval chains link initiator, reviewer, approver and releaser roles; tiers activate dynamically based on dollar threshold, payment type, corridor and counterparty.

A $5,000 domestic ACH might require only initiator and approver. A $500,000 international wire fires the full four-tier chain. Rules are deterministic — every transaction at a given dollar band produces a predictable approval path, auditable after the fact. Dual authorization on permission changes means no single admin can unilaterally grant themselves elevated privileges.

Onboarding a New User

Admin creates the user profile, selects roles and entity scope, sets dollar limits. An enrollment email goes to the user’s work address with a one-time activation code. User clicks, sets a password, registers MFA (soft token or FIDO2 hardware key), and is live within 10 minutes. Dual-authorization required on user creation.

Offboarding a Departing User

Admin deactivates. All active sessions are revoked within 90 seconds. Any workflows pending the user’s action reroute to the configured backup approver. The user profile is retained for audit but cannot authenticate. The audit log records the offboarding event with initiating admin and timestamp. Aligned with OCC expectations on privileged access lifecycle.

Periodic Access Review

Quarterly, the platform surfaces a user-role attestation report. Admin confirms every active user still requires their current role. Any unattested user is auto-moved to Read-Only after the review window. Report exports cleanly for the external examination file.