Follow Security Best Practices

Follow least-privilege, Business Unit data security, permission-group, and access-validation practices when securing Payables Agent.

Do	Don’t
Assign privileges based on user responsibility.	Don’t grant administrator access to operational users who need only review access.
Assign Business Unit data security with page or action access.	Don’t assume page access is enough for users to see invoice data.
Use roles that are enabled for permission groups.	Don’t assume classic Payables role inheritance applies to Payables Agent pages.
Process permission-group policies after role, privilege, or Business Unit changes.	Don’t validate access before permission-group processing is complete.
Restrict Capture edit access to administrators and implementation users.	Don’t enable broad access to ingestion setup.
Restrict Invoice Document Training edit access to authorized training users.	Don’t enable every invoice processor to update training data.
Restrict Compliance & Control management access to authorized policy owners.	Don’t enable users without policy responsibility to create or modify Invoice Completion policies or anomaly controls.
Assign view-only Compliance & Control access to users who need oversight butn't configuration authority.	Don’t grant management access when view access is sufficient.
Assign source-document download access only where required.	Don’t expose original invoice documents to users who don’t need them.
Validate access using pilot users from each role group.	Don’t validate only with administrator accounts.
Document the mapping between user groups, roles, privileges, and Business Units.	Don’t leave access decisions undocumented before production rollout.
Keep permission-group-based access and individual privilege design cleanly separated where required.	Don’t mix incompatible security architectures within a single duty role.