Review of existing user permissions and creation of new user roles
Restructuring of profilerole : Invoice Manager
The groupcorporate clientaccounting team users (profile name: Invoice manager) experience some limitations in their workflow with the current profile setup. Their user rights should be extended to view (read-only) the data on entity menus which helps them to reconcile what they can see in the user interface.
Creation of new profile : Supervisor
Furthermore,In the existingnew instance for IC and AA, the corporate accounting team will have a more restrictive user profile as invoices should be reviewed by users from other teams. This new role will be embeddedcalled in'supervisor' an
This androle teamwill context,have soidentical thatrights depending on the entity (and or team),as the invoice manager may have different rights, We will use this concept to withdraw the authorisation rights on invoices for IC and AA.
The group client instances will have the full invoice manager role as it is today with the suggestedexception improvements
Withinthat the IC and AA instancepermission for KAG,authorising/ invoice reviewer will then not be able to authorise/unauthoriseun-authorising invoices anymore.is withdrawn.
Creation of new profile : Invoice ReviewerExecutive
With the onboarding of Institutional Client and Alternative Assets users, a new user profile is required. The targeted workflow is that groupCorporate clientaccounting team users (role = Invoice Manager)supervisor) do the setup of agreements and invoice conditions in the user interface. Based on the data imported, invoices will then automatically be generated. The invoice managersupervisor will do the first validation step ('Validate') and the new role invoice reviewerexecutive will do the final validation step ('Authorise').
The export process (initiating the sending of invoices and production of accounting files) is then again in the hands of the invoice managers.supervisor.
To be able to review the invoice, the invoiceExecutive revieweruser needs to be able to see the invoice list. The list can be filtered by invoice group type to find more easily invoices related to either IC or AA.
From the invoice screen the Executive user can navigate to the agreement and check all settings. The invoice review report will be accessible as well and the preview of the pdf invoice produced. Both the Authorise and Un-Authorise Buttons will be available.
Overview of roles with context of entities and teams :
| Entity | Team | Role |
| AMG GC_AA | Corporate accounting | Invoice manager |
| AMG GC_AA | Corporate accounting | Administrator |
| AMG GC_AA | Auditor | Auditor |
| KAG GC | Corporate accounting | Invoice manager |
| KAG GC | Corporate accounting | Administrator |
| KAG GC | Auditor | Auditor |
| KAG IC_AA | Corporate accounting | |
| KAG IC_AA | ||
| KAG IC_AA | Auditor | Auditor |
Please see the attached (reviewed) user permissions. They have changed since the concept proposal to be even more restrictive.
Security matrix 2026 proposal 20260728.xlsx