Settings
Roles & permissions
Least privilege per role, with explicit scope (own / team / all) and separation between who creates and who approves.
Roles
Separation-of-duties conflict
This role can create/edit and approve in: Finance & refunds. Remove one, or enforce a “different approver” rule.
Finance officer
Invoices, reconciliation and refunds
Click a cell to cycle:OwnTeamAll
Internal users
MFA is mandatory for every role with approval rights