Access Groups Catalog (Catalogs.ГруппыДоступа) — UT for Kazakhstan 3.4.5.21

1. Identification

Purpose. "Access Groups" is a service catalog of the access rights management mechanism. Each item links a set of users (and/or user groups) with one access group profile (Catalog.AccessGroupProfiles) and, if necessary, with record-level access restrictions (RLS) by access kinds. It is precisely a user's membership in access groups that determines which roles are assigned to them and with which values (organizations, warehouses, partners, etc.) they are entitled to work.

Important: this is an object of the security subsystem, not an accounting document. It does not generate accounting entries or inventory/monetary movements. Nevertheless, it is precisely through access groups that access is regulated to documents that generate accounting records (for example, "Sales of Goods and Services," which in Kazakhstan generates entries Dt 1210 Ct 6010 for the amount of income and Ct 3130 for the amount of VAT at a rate of 16% — see §5).

Where to find it in 1C: Section "Master Data and Administration" → "Access Groups". Navigation link: e1cib/list/Catalog.AccessGroups.

2. Header attributes and tabular sections

Header attributes

Tabular section Users

Tabular section Restrictions (access restrictions / RLS)

3. Forms

A separate form "User Access Rights Setup" is called from the user card and works with this catalog indirectly, creating/supplementing personal access groups.

4. Key module procedures

No separate BSL evidence for the modules is attached to the object — below are the typical handlers of this SSL object (implemented in the object module and in common modules of the "Access Management" subsystem):

• FillingProcessing — when entering a new group, substitutes the name and set of access kinds from the selected profile.
• BeforeWrite — correctness control: verifying that access kinds correspond to the selected profile, prohibiting changes to the predefined Administrators group in invalid scenarios, checking the current user's administration rights.
• OnWrite — key procedure: initiates recalculation and update of the service registers of access management (see §5) for all group members.
• BeforeDelete / deletion mark processing — cascading update of registers so that users correctly lose the roles and restrictions of the deleted group.
• Procedures of common modules AccessManagement, AccessManagementInternal — calculation of access value sets, update of user membership in groups, recalculation of role rights.

Requires verification (version-specific): the exact composition of the internal RLS update procedures depends on the version of SSL built into 3.4.5.21.

5. Posting and movements

The catalog is not posted — catalogs have no posting mechanism, so it does not generate accounting entries or inventory/monetary movements.

Instead, when an item is written/changed, the SSL mechanism synchronously updates the service information registers of the access management system:

It is precisely these movements that are subsequently used in access restriction templates (RLS) when reading/writing application objects.

Connection to accounting (context, not movements of the catalog itself). Rights granted through access groups determine access to Kazakhstan accounting documents. For example, a user with the "Sales Manager" profile and an allowed organization posts a "Sales of Goods and Services," which generates entries:

• Dt 1210 (short-term accounts receivable from customers) Ct 6010 (revenue from sales) — for the amount of revenue;
• Ct 3130 (VAT payable) — for the amount of VAT at a rate of 16%;
• Dt 7010 (cost of sales) Ct 1330 (goods) — for the cost;
• upon payment Dt 1030 (cash in current accounts) Ct 1210; upon purchase — Dt 1330/1420 Ct 3310.

These entries themselves are created by accounting documents, not by the "Access Groups" catalog; the latter only allows or prohibits working with them and electronic documents (ESF in the ESF IS, waybills) broken down by access kinds.

6. Related objects and entry based on

Direct connections:

• Catalog.AccessGroupProfiles — source of roles and the list of access kinds (attribute Profile).
• Catalog.Users, Catalog.UserGroups, Catalog.ExternalUsers, Catalog.ExternalUserGroups — composition of members (tabular section "Users").
• ChartOfCharacteristicTypes.AccessKinds and value catalogs (Organizations, Warehouses, Partners, Individuals, etc.) — RLS restrictions.
• Service information registers of the "Access Management" subsystem — receivers of movements (§5).

Entry based on: not provided. Personal access groups are created automatically from the rights setup form of a specific user, not by the "Enter Based On" mechanism.

7. Extension points

• Overridable SSL common modules: AccessManagementOverridable, RecordLevelAccessRestrictionsOverridable — registration of custom access kinds, restriction templates, and access groups during customization.
• Event subscriptions / object module extensions — control of member composition, audit of access group changes, integration with external account management systems.
• Configuration extensions — adding attributes/forms without removing from support; changing the RLS update logic should be done with extreme caution.
• Profiles as the main configuration tool — it is recommended to configure rights through AccessGroupProfiles, and use access groups for binding to specific users and values, without "blurring" the role logic.

Requires verification (version-specific): the specific set of overridable procedures and predefined access kinds depends on the SSL version included in Trade Management for Kazakhstan 3.4.5.21.