Permissions reference - Tesouro

Permissions control what actions an organization user can take within a specific domain. Each permission has a domain:action:scope key — permissions are assigned to roles, and roles are assigned to users. See the Roles guide for how to create roles and assign permissions.

Permission model

Permission keys follow a domain:action:scope pattern — for example, expense:read:org or payable:pay:self. The scope is either :org (all objects in the organization) or :self (the user’s own objects, plus their direct reports’ expenses). See Reporting manager for how direct-report relationships work.

write permissions cover create, update, and delete — and implicitly include read. read-only permissions are for roles that should see data but not change it.

Permissions reference

Users and roles

Permission key	Description	System roles
`user:read:org`	View all organization users	Company admin
`user:write:org`	Create and update organization users	Company admin
`role:read:org`	View roles and their permissions	Company admin

Organization

Permission key	Description	System roles
`organization:read:org`	View organization information and settings	Company admin
`organization_settings:read:org`	View organization-level configuration	Company admin
`organization_settings:write:org`	Update organization-level configuration	Company admin

Bank accounts

Permission key	Description	System roles
`bank_account:read:org`	View all bank accounts in the organization	Company admin, Finance admin, Bookkeeper
`bank_account:write:org`	Create and manage bank accounts	Company admin
`external_bank_account:read:org`	View external bank accounts linked to the organization	Company admin
`external_bank_account:write:org`	Add and manage external bank accounts	Company admin
`external_bank_account:micro_deposit:org`	Initiate micro-deposit verification for external bank accounts	Company admin

Counterparts

Permission key	Description	System roles
`counterpart:read:org`	View all counterparts	Company admin, Finance admin, Bookkeeper
`counterpart:write:org`	Create and update counterparts	Company admin, Finance admin

Invoices (AR)

Invoice permissions cover the full accounts receivable surface: invoices, payment reminders, overdue reminders, delivery notes, products, and AR-side payment records.

Permission key	Description	System roles
`invoice:read:org`	View all invoices	Company admin, Finance admin, Bookkeeper
`invoice:write:org`	Create, update, and manage invoices	Company admin, Finance admin

Payables (AP)

Payable permissions cover the full accounts payable surface: payables, purchase orders, credit notes, and AP-side payment records.

Permission key	Description	System roles
`payable:read:org`	View all payables	Company admin, Finance admin, Bookkeeper
`payable:write:org`	Create and update payables	Company admin, Finance admin
`payable:approve:org`	Force-approve a payable, bypassing the normal approval workflow. Company admin only.	Company admin
`payable:pay:org`	Execute payment of approved payables	Company admin, Finance admin

Payment records

Permission key	Description	System roles
`payment_record:read:org`	View all payment records	Company admin, Finance admin, Bookkeeper
`payment_record:write:org`	Create and manage payment records	Company admin, Finance admin

Expenses

Expense permissions cover transactions and receipts — read includes viewing receipts, write includes creating and updating them.

Permission key	Description	System roles
`expense:read:org`	View all expense transactions in the organization	Company admin, Bookkeeper
`expense:write:org`	Create and update all expense transactions in the organization	Company admin
`expense:read:self`	View the user’s own expense transactions, and those of their direct reports	Finance admin, Employee
`expense:write:self`	Create and update the user’s own expense transactions, and those of their direct reports	Finance admin, Employee
`expense:approve:org`	Force-approve an expense transaction, bypassing the normal approval workflow. Company admin only.	Company admin

Transfers

Permission key	Description	System roles
`transfer:write:org`	Initiate a transfer between bank accounts the organization owns. Not the same as paying an external vendor — use `payable:pay:org` for bill payment.	Company admin, Finance admin

Approval policies and requests

Permission key	Description	System roles
`approval_policy:read:org`	View approval policies	All
`approval_policy:write:org`	Create, update, and delete approval policies	Company admin
`approval_request:read:org`	View approval requests. Company admin: also used for cancelling requests via API — not used in components	All

Accounting configuration

Accounting configuration permissions cover ledger accounts, tax rates, cost centers, tags, and projects.

Permission key	Description	System roles
`accounting_config:read:org`	View accounting configuration including ledger accounts and tax rates	Company admin, Bookkeeper
`accounting_config:write:org`	Create and update accounting configuration	Company admin

Exports

Permission key	Description	System roles
`export:read:org`	View and download data exports	Company admin, Bookkeeper
`export:write:org`	Create and manage data exports	Company admin, Bookkeeper