> ## Documentation Index > Fetch the complete documentation index at: https://docs.tesouro.com/llms.txt > Use this file to discover all available pages before exploring further. # Permissions reference > All user-assignable permissions available for FinOps custom roles. Permissions control what actions an organization user can take within a specific domain. Each permission has a `domain:action:scope` key — permissions are assigned to roles, and roles are assigned to users. See the [Roles guide](/finops/guides/roles/index) for how to create roles and assign permissions. ## Permission model Permission keys follow a `domain:action:scope` pattern — for example, `expense:read:org` or `payable:pay:self`. The scope is either `:org` (all objects in the organization) or `:self` (the user's own objects, plus their direct reports' expenses). See [Reporting manager](/finops/guides/roles/index#reporting-manager) for how direct-report relationships work. `write` permissions cover create, update, and delete — and implicitly include `read`. `read`-only permissions are for roles that should see data but not change it. ## Permissions reference ### Users and roles | Permission key | Description | System roles | | ---------------- | ------------------------------------ | ------------- | | `user:read:org` | View all organization users | Company admin | | `user:write:org` | Create and update organization users | Company admin | | `role:read:org` | View roles and their permissions | Company admin | ### Organization | Permission key | Description | System roles | | --------------------------------- | ------------------------------------------ | ------------- | | `organization:read:org` | View organization information and settings | Company admin | | `organization_settings:read:org` | View organization-level configuration | Company admin | | `organization_settings:write:org` | Update organization-level configuration | Company admin | ### Bank accounts | Permission key | Description | System roles | | ----------------------------------------- | -------------------------------------------------------------- | ---------------------------------------- | | `bank_account:read:org` | View all bank accounts in the organization | Company admin, Finance admin, Bookkeeper | | `bank_account:write:org` | Create and manage bank accounts | Company admin | | `external_bank_account:read:org` | View external bank accounts linked to the organization | Company admin | | `external_bank_account:write:org` | Add and manage external bank accounts | Company admin | | `external_bank_account:micro_deposit:org` | Initiate micro-deposit verification for external bank accounts | Company admin | ### Counterparts | Permission key | Description | System roles | | ----------------------- | ------------------------------ | ---------------------------------------- | | `counterpart:read:org` | View all counterparts | Company admin, Finance admin, Bookkeeper | | `counterpart:write:org` | Create and update counterparts | Company admin, Finance admin | ### Invoices (AR) Invoice permissions cover the full accounts receivable surface: invoices, payment reminders, overdue reminders, delivery notes, products, and AR-side payment records. | Permission key | Description | System roles | | ------------------- | ----------------------------------- | ---------------------------------------- | | `invoice:read:org` | View all invoices | Company admin, Finance admin, Bookkeeper | | `invoice:write:org` | Create, update, and manage invoices | Company admin, Finance admin | ### Payables (AP) Payable permissions cover the full accounts payable surface: payables, purchase orders, credit notes, and AP-side payment records. | Permission key | Description | System roles | | --------------------- | ------------------------------------------------------------------------------------ | ---------------------------------------- | | `payable:read:org` | View all payables | Company admin, Finance admin, Bookkeeper | | `payable:write:org` | Create and update payables | Company admin, Finance admin | | `payable:approve:org` | Force-approve a payable, bypassing the normal approval workflow. Company admin only. | Company admin | | `payable:pay:org` | Execute payment of approved payables | Company admin, Finance admin | ### Payment records | Permission key | Description | System roles | | -------------------------- | --------------------------------- | ---------------------------------------- | | `payment_record:read:org` | View all payment records | Company admin, Finance admin, Bookkeeper | | `payment_record:write:org` | Create and manage payment records | Company admin, Finance admin | ### Expenses Expense permissions cover transactions and receipts — `read` includes viewing receipts, `write` includes creating and updating them. | Permission key | Description | System roles | | --------------------- | ------------------------------------------------------------------------------------------------- | ------------------------- | | `expense:read:org` | View all expense transactions in the organization | Company admin, Bookkeeper | | `expense:write:org` | Create and update all expense transactions in the organization | Company admin | | `expense:read:self` | View the user's own expense transactions, and those of their direct reports | Finance admin, Employee | | `expense:write:self` | Create and update the user's own expense transactions, and those of their direct reports | Finance admin, Employee | | `expense:approve:org` | Force-approve an expense transaction, bypassing the normal approval workflow. Company admin only. | Company admin | ### Transfers | Permission key | Description | System roles | | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | | `transfer:write:org` | Initiate a transfer between bank accounts the organization owns. Not the same as paying an external vendor — use `payable:pay:org` for bill payment. | Company admin, Finance admin | ### Approval policies and requests | Permission key | Description | System roles | | --------------------------- | --------------------------------------------------------------------------------------------------------- | ------------- | | `approval_policy:read:org` | View approval policies | All | | `approval_policy:write:org` | Create, update, and delete approval policies | Company admin | | `approval_request:read:org` | View approval requests. Company admin: also used for cancelling requests via API — not used in components | All | ### Accounting configuration Accounting configuration permissions cover ledger accounts, tax rates, cost centers, tags, and projects. | Permission key | Description | System roles | | ----------------------------- | --------------------------------------------------------------------- | ------------------------- | | `accounting_config:read:org` | View accounting configuration including ledger accounts and tax rates | Company admin, Bookkeeper | | `accounting_config:write:org` | Create and update accounting configuration | Company admin | ### Exports | Permission key | Description | System roles | | ------------------ | ------------------------------ | ------------------------- | | `export:read:org` | View and download data exports | Company admin, Bookkeeper | | `export:write:org` | Create and manage data exports | Company admin, Bookkeeper |