Roles & Permissions

This article describes who can do what in AI Finance Team: how an accounting firm and its clients are organised, which permissions exist and who holds them, how custom roles and exceptions change them, and how people join, are invited and are removed.

How the platform is organised

AI Finance Team connects accounting firms with their clients:

• An organization is an accounting firm or practice.
• A workspace is one client engagement: the firm works in it, and the client's people use it too. Accountants usually work across many workspaces; client users see only their own.

Every workspace member is on the firm side (they work for the accounting firm) or the client side (they work for the client). The side comes from how the person joined. It belongs to the membership, not to a role, and no role can change it. Some permissions are firm-only: they can never be given to someone on the client side.

The organization

Members of an accounting firm have an organization role, Admin or Member. When no workspace is open, the sidebar shows Organization with these pages:

• General, Manage workspaces, Team, AI access and Support access, for every member of the firm;
• Billing, for admins, where billing is switched on.

Admins invite people to the firm, make a member an admin or an admin a member, and remove people. Removing someone from the firm also removes them from every workspace of the firm; the last admin cannot be removed. Members see the firm's team but cannot change it.

Client users have no organization role. They exist only in the workspaces they were invited to.

Permissions

Every workspace member has one role, and a role is a named set of permissions. Every workspace has five system roles, and its managers can add custom roles for that workspace.

The ticks are the defaults of the five system roles. A custom role picks its own set, and an exception changes a single member. "Push into the accounting system" also needs the connection to be switched on for the workspace.

Two things are fixed by rule and are never part of a role:

• Connecting and disconnecting bank accounts. Any client-side member can connect a bank; disconnecting a bank connection belongs to the finance lead. Bank credentials always stay on the client side.
• NAV Online Számla credentials can be set up by the finance lead, an accountant admin or an accountant. Nobody can read them back.

Both are decided by the member's base role (the system role a custom role is based on), so a custom role based on Finance lead also owns the bank connection.

What the broader permissions cover:

• Edit custom categories: setting a custom category on an invoice line or a bank transaction, and fixing one for a partner on the list's page. A member who can edit the invoice or the bank transaction can set it without this permission. The lists themselves need Edit master data.
• Edit master data: partners, categories, transaction types, the VAT setup, custom category lists and the ledger defaults.
• Edit workspace settings: numbering, currency, AI and data settings.
• Manage connections: the workspace's email address for incoming documents and the Business Central link.
• Approve invoices for payment, Manage approvals and Export payment file: see Setting Up Payment Approvals and Paying Approved Invoices.

System roles

System roles cannot be changed. On the Roles tab, click the row of one to see, read-only, what a member on that role can do.

Custom roles

Open Settings → Team management → Roles in the workspace.

1. The tabs of Team management.
2. A system role. Click the row to see, read-only, what the role can do. The ⋯ menu at the end of the row holds View and Duplicate.
3. A custom role, based on a system role of its side. The line under its name says which. Its ⋯ menu holds View, Edit and Archive.
4. Add role.

• Add role creates a role with nothing ticked (on the client side, "Invite members" starts ticked); Duplicate starts from an existing role's permissions. A custom role is based on a system role of the same side, and a firm-only permission is not offered for a client-side role.
• You can only give permissions you hold yourself.
• Everyone who opens the tab sees every role, but a client-side manager cannot change firm-side roles.
• Assign a role on a member's access page, or pick it when inviting someone.
• A role that members still hold cannot be archived; move them to another role first.
• Custom roles belong to the workspace they were created in.

Parts of the app that have not moved to permissions yet still behave like the member's base role, as the Roles tab notes.

Exceptions for one member

On the Team members tab, Edit access next to a member opens their access page. There a manager can change the member's role and add an exception: give one permission the role lacks, or take away one it has. The rules:

• you can only give or take away a permission you hold yourself;
• you cannot change your own access;
• an exception that the role already answers the same way is refused.

The page lists What this member can do, and where each answer comes from: From role, Exception, added, Exception, removed, Fixed by rule or Not available on the client side. Every member can see their own access under My access.

Viewing invoices and bank transactions comes first

"View invoices and bank transactions" is a prerequisite of every permission that shows or changes the books: editing invoices and transactions, matching, exports, closing, reports, master data, the payment file, managing approvals, the two checkpoint approvals and sending to the accounting system. While it is off, those read Needs viewing and cannot be switched on; switch it back on and they return as the role gives them.

Without it a member uploads documents and sees only their own, not the company's finances:

• Invoices: the ones they uploaded (by hand, in a ZIP, or by e-mail from their own address), read only.
• Bank transactions: the ones that came from bank statements they uploaded, with the bank feed's details where the feed brought the same item. Nothing that came only from the bank feed.
• Approvals: the invoices routed to them for approval, which they can open, approve or decline.
• Intake and Messages: the e-mails they sent in, and the threads about their own documents or ones they wrote in.

Reports, Exports and the payment file are not in their menu, and the dashboard shows their own uploads and the approvals waiting for them.

For the accounting firm's members it cannot be taken away. It reads Always on for the accounting firm: an accountant who cannot see the books has nothing to do in the workspace.

Managing the team

"Manage members and roles" is what makes someone a manager of the team. It lets them change a member's role, set exceptions, remove members and, on the firm side, decide join requests. A client-side manager (the finance lead by default) manages client-side members only. The last accountant admin and the last finance lead of a workspace cannot be removed, cannot leave, and cannot be moved to another base role.

What a member sees

The sidebar follows the member's side and permissions, but hiding a menu item is not the protection: what a member can read or change is decided by their permissions in the database. A custom role without "Close periods" is turned away from Closing however they got there.

What each role sees

These tables show the defaults of the five system roles; a custom role or an exception changes them.

Sidebar

Approvals appears for members holding "Approve invoices for payment" or "Manage approvals", and Payment file for those holding "Export payment file". Missing receipts appears only where that feature is switched on for the workspace (see Missing Receipts). Under Master data, client-side members see Companies, Bank accounts, Accounting categories and Custom categories; Partners, Bank Transaction Types, VAT groups and the VAT setup are firm-only.

Settings → Team management

Invoices

Clients submit the documents; the accountants categorise and check them.

Reports

How membership works

Inviting people

The workspace's Settings → Team management → Invite a new member (for members holding "Invite members") and the organization's Team page (for organization admins) have the same invite panel. It queues up to 10 invitations at once:

• One row per person: the email address, the role, and optionally their Name and Language. With a name, the invitation email greets them by name and the sign-up form is filled in.
• An optional message, up to 500 characters, shared by the whole batch. Links in it become clickable.
• Click Send invite, or Send N invites for several. Rows that were sent drop out of the form; rows that failed (for example a duplicate email address) stay with the error so you can fix them.

The role list depends on who invites. A firm-side inviter (an Accountant admin, or an Accountant who has been given the right) can invite any workspace role. A client-side inviter can invite any client-side role, but a Finance lead can be invited only by another Finance lead (or by a firm-side member holding the right); a client-side inviter never invites into an accountant role. A custom role behaves like the role it is based on. The organization panel invites to the firm.

Under the description, Who can invite whom? has an info icon: hover over it (or focus it with the keyboard) to see the invitation matrix of this workspace, one row per role that may invite and one column per role that can be invited. Individual exceptions are not in the matrix.

Every built-in client role holds "Invite members" by default; the right can be taken from one person on their access page. Custom roles that already existed keep the permissions they were given. A new client-side custom role starts with the right ticked.

AI Finance Team emails each person the invitation link and your message; the link is also shown to you in case the email does not arrive. Each invitation expires after 14 days, can be revoked before it is accepted, and only works for the email address it was sent to.

Accepting an invitation

When the person opens the link:

• if they are not signed in, they sign in or sign up, and the invitation is kept through it;
• if they are signed in with a different email address, Wrong account? offers Sign in with a different account;
• once accepted, a workspace invitation adds them to the workspace and opens it; an invitation with an accountant role also makes them a member of the firm. An organization invitation adds them to the firm's team.

Joining a workspace

There are three ways into a workspace:

1. An invitation, as above.
2. An organization admin adds themselves: under Organization → Manage workspaces, they pick a role (Accountant by default) and click Add me. An admin who opens a firm workspace they are not a member of sees a banner with Add me as a member.
3. An organization member asks to join: under Organization → Manage workspaces, they pick Accountant or Accountant admin and click Ask to join. The workspace's accountant admins and the firm's admins get an email. The request is decided in the workspace under Settings → Team management → Pending requests by a firm-side member holding "Manage members and roles": Approve, with the role requested or another one, or Deny. The person is told by email either way.

Removing a member

A member holding "Manage members and roles" can remove a member on their own side from the Team members tab: by default, the accountant admin removes firm-side members and the finance lead removes client-side members. Any member can leave a workspace themselves, except the last accountant admin and the last finance lead. Removed people keep their account; they only lose access to that workspace. Removing someone from the organization (on its Team page) removes them from every workspace of the firm.