Verified on release 3.4.5.21 "Trade Management for Kazakhstan" (edition 3.4).
A retail manager complains: he sees wholesale items and the supplier's closed price list in the item catalog, which he isn't supposed to know about. Meanwhile a warehouse keeper accidentally wrote off goods from someone else's warehouse-direction, because it shouldn't have been visible to him at all. You open the item list under different users — and realize everyone sees everything. This is where working with the "Item Access Groups" catalog begins: it's the "switch" you use to divide items into visible and invisible for specific employees.
1. Purpose
The catalog stores group labels used to restrict user access to items at the record level (RLS). You assign an access group to an item, and then in user rights you allow or deny that group. The catalog itself doesn't calculate or post anything — it only marks items for the access restriction mechanism.
2. Where to find it
The catalog appears in the interface only after enabling access restriction:
- Master Data and Administration → Master Data and Section Settings → Items — check the "Item Access Groups" checkbox.
- After that: Master Data and Administration → See also → Item Access Groups (or via the rights settings section).
Direct navigation link (menu "Tools → Go to navigation link", or Ctrl+F in the address bar):
e1cib/list/Справочник.ГруппыДоступаНоменклатуры
If the checkbox is not enabled, the "Access Group" attribute on the item card is hidden, and the catalog itself is not shown in the command interface.
2a. How to find your release
Main menu (≡ icon or "Tools") → Help → About. The window that opens shows the platform version (e.g., 8.3.24.x) and the configuration release — a line like "Trade Management for Kazakhstan, edition 3.4 (3.4.5.21)". It's the configuration release that matters: the interface and set of settings change between releases.
3. How to fill it in
The catalog is deliberately simple — the "magic" isn't in its fields, but in where you use them afterward.
| Field | Required? | Why, and what happens if wrong |
|---|---|---|
| Name | Yes | The group name you'll select in the item card and in rights settings. Give it a meaningful name based on access logic: "Retail", "Wholesale", "Alcohol", "Closed price list". If you call it "Group1", in a month you won't remember who it's open to, and you'll assign rights at random. |
| Code | Assigned automatically | Unique identifier. Don't touch it manually — the group is linked to items by it. |
| Comment (if shown) | No | An explanation for colleagues about who the group is intended for. An empty field doesn't hurt anything, but it makes handover harder. |
The full setup sequence (the catalog is only the first step):
- Create access groups. Use the "Create" button to set up as many groups as you have real "walls" between employees. Don't create extra ones: 3–5 groups is usually enough.
- Link items. In the item card (Master Data → Items), fill in the "Item Access Group" attribute. It's more convenient to use bulk processing: select items in the list → "More → Edit selected" → the "Access Group" attribute. Items without an access group fall under the "empty group" rule — decide in advance whether everyone or no one sees them.
- Assign rights. Master Data and Administration → User and Rights Settings → User Access Groups (or access profile): in the restrictions by access type "Item Access Groups", specify which groups are allowed for the selected profile.
- Check as a user. Log in (or use "All functions → Run as user") and make sure the item list shows only what's allowed.
There's essentially one required field — Name. Everything else depends on how you use the group.
4. Worked example
This catalog isn't an accounting one, so the "hook" here isn't journal entries but a working access-restriction scenario. This object doesn't create journal entries (see section 6), so I'll show the whole chain plus one monetary example of a sale that the restriction protects.
Task. You have two managers. Petrov handles retail, Sidorov handles wholesale with a closed price list. Petrov shouldn't see wholesale items.
Steps:
- In the catalog, create two groups: "Retail" and "Wholesale".
- Item "Smartphone A" (retail) → group "Retail"; item "Batch of smartphones, box of 50 pcs" (wholesale) → group "Wholesale".
- In Petrov's profile, for the "Item Access Groups" access type, allow only "Retail".
- Result: Petrov sees only "Smartphone A" in the item list. The wholesale item is physically absent for him — it can't be selected into a document or its balance viewed.
What this means in money. When Petrov rings up a retail sale of "Smartphone A" for 116,000 ₸ (including VAT 16% = 16,000 ₸, cost excluding VAT 100,000 ₸, cost of goods 70,000 ₸), the sales document generates standard KZ journal entries:
| Dr | Cr | Amount, ₸ | Description |
|---|---|---|---|
| 1210 | 6010 | 116,000 | Revenue recognized from customer |
| 6010 | 3130 | 16,000 | VAT payable accrued (16%) |
| 7010 | 1330 | 70,000 | Cost of goods written off |
These journal entries are created by the sales document, not the catalog. The catalog's role is to guarantee that Petrov can't even substitute a wholesale item from someone else's group into this document. That is, the access group doesn't change any figures, but it protects the correctness of input data.
5. Operation types
The catalog doesn't have "operation types" in the sense a document does. In practice, it's used in two modes:
- Allowing — the user is given a list of specific groups (sees only their items).
- Denying/default — everything not allowed is hidden; items with an empty access group are governed by a separate profile rule.
6. What is generated when used
The catalog is not posted and does not generate accounting entries, e-invoices (ESF), or e-waybills (SNT) — it's a master data element, not a document. Recording an element only produces a new catalog row with a unique code.
The real "movements" occur in the access mechanism:
- the group value is written to the "Access Group" attribute on the item card;
- in rights settings, this value is entered into the access value register for the "Item Access Groups" access type;
- the platform applies an RLS restriction: SQL queries to item tables and related registers automatically get a filter for allowed groups applied.
E-documents (ESF via the ESF information system, SNT) are generated by sales/receipt documents and depend on this catalog only indirectly — through which items the user is allowed to add to them.
7. Printed forms
The catalog has no printed forms of its own — there's no need to print an "access group." Standard service outputs are available from the list: "More → Print list" (a spreadsheet/text document for reconciling the list of groups) and printing this list. For reporting on actual access restrictions, see Administration → access rights reports.
8. Common errors
"Insufficient rights to view/edit the 'Item' element." The user is trying to open an item from a group they're not allowed. Fix: add the needed group to the employee's access profile, or move the item to an allowed group.
"The 'Item Access Group' field is not filled in" / the item is visible to everyone. The item's group attribute is empty. Fix: fill in the group using bulk "Edit selected" processing and configure the rule for an empty group in the profile.
The catalog is not visible in the menu. The Master Data and Administration → Items → "Item Access Groups" checkbox isn't enabled. Enable it — the command will appear.
"The record was changed or deleted by another user." Two people are editing the same group/assigning rights at the same time. Fix: refresh the form (F5) and try again; coordinate rights changes through a single responsible person.
After setup, the manager still sees extra items. Rights are applied at login — ask the user to log in again, RLS is cached per session.
9. FAQ
Does this catalog create journal entries? No. It's a master data catalog. Journal entries (Dr 1210 Cr 6010, VAT to 3130 at 16%, etc.) are created by sales and receipt documents, not by it.
How is item access group different from item type and from group (folder)? Item type defines a set of item properties, a folder is a visual hierarchy, and an access group is exclusively about rights: who is allowed to see these items at all.
Where did the "Access Group" attribute in the item card go? It's shown only when the "Item Access Groups" checkbox is enabled in master data settings. Enable the setting.
Can one item be assigned several access groups? No, there's only one attribute — an item has exactly one access group. Combine access on the user profile side.
What does a user see if they're not allowed any group? Only items with an empty group (if the profile rule permits this) or nothing at all. Configure the rule for the empty value deliberately.
Does the access group affect VAT, cost of goods, or amounts in documents? No. It doesn't affect figures: VAT 16%, accounts 1210/6010/7010/3130 work the same for all items. It only affects visibility.
How can I quickly assign a group to hundreds of items? In the item list, select items → "More → Edit selected" → the "Item Access Group" attribute → select a value.
Why didn't rights changes take effect immediately? Record-level restrictions are applied at session login. The user needs to log in again.
Can an access group be deleted? Mark it for deletion, but first remove it from all items and profiles — otherwise referential integrity control won't allow deletion.
Does the restriction work in the mobile/thin client? Yes, RLS is applied at the platform level regardless of the client.
10. Related documents
- Based on what it's filled in: a standalone master data element, entered manually. Based on organizational access policy (who should see what).
- Where it's used: the "Access Group" attribute of the "Items" catalog; "User Access Groups" / "Access Group Profiles" settings (the "Item Access Groups" access type).
- What it indirectly affects: "Sales of Goods and Services", "Receipt of Goods and Services" documents, orders, transfers — it restricts the list of items available to the user for selection, and therefore the composition of future ESF/SNT.
How to find your release
Help → About. The configuration line will show edition 3.4 and the release number; the platform line shows version 8.3.x. Always match the instructions to your configuration release.
This guide was prepared and verified on release 3.4.5.21 "Trade Management for Kazakhstan" (edition 3.4).