Restructuring of current user permission and adding a new role type
Restructuring of profile : Invoice Manager
The group client users (profile name: Invoice manager) experience some limitations in their workflow with the current profile setup. Their user rights should be extended to view (read-only) the data on entity menus which helps them to reconcile what they can see in the user interface.
Furthermore, the existing role will be embedded in an entity and team context, so that depending on the entity (and or team), the invoice manager may have different rights, We will use this concept to withdraw the authorisation rights on invoices for IC and AA.
The group client instances will have the full invoice manager role as it is today with the suggested improvements
Within the IC and AA instance for KAG, invoice reviewer will then not be able to authorise/unauthorise invoices anymore.
Creation of new profile : Invoice Reviewer
With the onboarding of Institutional Client and Alternative Assets users, a new user profile is required. The targeted workflow is that group client users (role = Invoice Manager) do the setup of agreements and invoice conditions in the user interface. Based on the data imported, invoices will then automatically be generated. The invoice manager will do the first validation step ('Validate') and the new role invoice reviewer will do the final validation step ('Authorise').
The export process (initiating the sending of invoices and production of accounting files) is then again in the hands of the invoice managers.
To be able to review the invoice, the invoice reviewer needs to be able to see the invoice list. The list can be filtered by invoice group type to find more easily invoices related to either IC or AA.
From the invoice screen the user can navigate to the agreement and check all settings. The invoice review report will be accessible as well and the preview of the pdf invoice produced.
Overview of roles with context of entities and teams :
| Entity | Team | Role |
| AMG GC_AA | Corporate accounting | Invoice manager |
| AMG GC_AA | Corporate accounting | Administrator |
| AMG GC_AA | Auditor | Auditor |
| KAG GC | Corporate accounting | Invoice manager |
| KAG GC | Corporate accounting | Administrator |
| KAG GC | Auditor | Auditor |
| KAG IC_AA | Corporate accounting | Invoice manager (except no authorisation un-authorisation anymore) |
| KAG IC_AA | IC_AA | Invoice reviewer |
| KAG IC_AA | Auditor | Auditor |
Please see the attached (reviewed) user permissions. They have changed since the concept proposal to be even more restrictive.
Security matrix 2026 proposal 20260728.xlsx