Who can see and do what in finance
Which finance pages each role can open, what each role can change there, and which rows each viewer sees.
Overview#
Finance access works in two layers. A role's permissions decide which finance pages appear in the sidebar and which actions those pages offer. The organisation the user belongs to then decides which rows they see: a tenant user sees its own tenant's money, a merchant user its own merchant's, and a platform operator everyone's. Supervisors see almost nothing in finance: a Tenant Supervisor sees only B2B-Direct credit accounts and the Credit Exposure report, and a Merchant Supervisor sees no finance page at all.
Permissions#
What each role can use on the wallet and payment pages of the Finance section. Invoice pages in the same section are covered with invoicing.
| Page | Tenant Owner, Admin | Tenant Accountant | Tenant Supervisor | Merchant Owner, Admin | Merchant Accountant | Platform Operator |
|---|---|---|---|---|---|---|
| Wallets | View, request provider setup | View | — | View, request provider setup | View | View, switch a wallet or its provider on and off |
| Credit Summary | View | View | — | — | — | — |
| Credit Allocations | — | — | — | — | — | Grant, adjust, revoke, record repayment |
| B2B Credit Accounts | View | View | View | View, grant, adjust limit, record payment | View, record payment | View, adjust limit, record payment, suspend, close, reactivate |
| B2B-Direct Routes | — | — | — | — | — | Add, change, remove |
| Receiving Account | — | — | — | View, add, change, delete | — | View |
| Provider Configuration | — | — | — | — | — | Add, change |
| B2B-Direct Amounts Owed | View | View | — | — | — | View |
| Transactions | View | View | — | View | View | View |
| Money Movements | View, re-issue a failed payment | View, re-issue a failed payment | — | View | View | View, re-issue a failed payment |
| Ledger Entries | View | View | — | View | View | View |
| Reconciliation Reports | — | — | — | — | — | View |
Provider details are shown to tenant and merchant owners and admins on their own wallet's page; only the platform operator configures them. Who can open each finance report (Spend Summary, Balance & Runway, Wallet Statement, Credit Exposure) is on Finance reports and Balance and runway.
For B2B-Direct credit, merchant owners and admins manage the credit they extend, the merchant accountant records the tenant's payments, and tenant roles only view. Tenant Supervisors can view the accounts so they can open the B2B credit notifications they receive; Merchant Supervisors have no B2B credit access. The platform operator oversees every account.
Rules#
Whose rows you see#
| Records | Tenant user | Merchant user |
|---|---|---|
| Wallets, ledger entries | Wallets the tenant owns | Wallets the merchant owns |
| Transactions | The tenant's transactions | Transactions with the merchant |
| Money movements | Movements on the tenant's transactions | Movements on transactions with the merchant, plus any movement that pays the merchant |
| B2B-Direct credit accounts | Lines granted to the tenant | Lines the merchant granted |
| Receiving accounts | None | The merchant's own |
A merchant sees money it receives even when the transaction behind it names no merchant; this widening applies to money paid to the merchant only, never to money it pays, and never to tenants. Opening a record of another organisation by its address shows "not found".
Links you cannot follow, parties you may not see#
- A link on a finance page is shown only when the viewer may open the page it leads to. Otherwise the same reference appears as plain text, so a link never leads to a refusal.
- When a payment involves a party the viewer is not entitled to see, the party appears in an anonymous form such as "Merchant #12", unlinked and marked as not shared — never as a blank, a dash or "Unknown".
- Platform-only detail on a payment page — the provider used, the provider's own failure text and the dispatch attempts — is left out of the page entirely for non-operators, not merely hidden. The raw provider request and response are shown to no one. Every viewer of a failed payment sees a plain-language failure reason.