Verified on release 3.4.5.21 "Trade Management for Kazakhstan" (edition 3.4).
Situation. The wholesale manager opens the list of partners and sees absolutely everyone — including clients of another department and VIP counterparties that only the director works with. Someone leaked the database to competitors, and questions started coming up. You decide to restrict access: let each manager see only "their own." The tool for this is the "Partner Access Groups" catalog. This is not a document and it doesn't generate postings. These are "labels" you use to mark partners so you can later grant rights: who sees which group.
1. Purpose
The catalog stores the list of groups by which you divide partners to restrict record-level access (RLS). By itself it doesn't calculate or post anything — it works together with the rights settings: a partner is assigned an access group, and a user's profile is allowed to work only with certain groups. The result — a manager sees and edits only those clients who fall into the groups allowed for them.
2. Where to find it
The catalog is visible only when record-level access restriction is enabled. Procedure:
- Master data and administration → User and rights setup → Access restriction — check the box "Restrict access at the record level."
- In the "Access types" group, enable access by "Partner groups" (in some profiles it is called "Partners").
- After that, the list of groups itself opens: Master data and administration → User and rights setup → Partner access groups (or via the partner card, "Access group" field).
A quick way to open it directly is the menu "Service → Go to navigation link" and paste:
e1cib/list/Справочник.ГруппыДоступаПартнеров
2a. How to check your release
Help → About the program (or "i" in the top right corner). There you'll find the line "Trade Management for Kazakhstan, edition 3.4 (3.4.5.21)" and the 1C:Enterprise platform version. If you have a different release — some menu items may be named differently, but the logic of the catalog does not change.
3. How to fill it in
The catalog is intentionally simple. Filling it in is divided into three steps: create a group, assign partners to it, grant rights.
Step 1. Create a group — the "Create" button
| Field | Required | Purpose and consequences of an error |
|---|---|---|
| Name | Yes | The only meaningful field. Name it according to the purpose of the division: "Wholesale department," "VIP clients," "Almaty Retail." If you name it vaguely ("Group1"), later when granting rights you will confuse yourself about who should see what, and a manager will see something they shouldn't. |
| Comment | No | For your own reference: the principle by which partners were grouped. Does not affect access. |
There are no attributes like "rate," "account," "currency" here — this is an access classifier, not an accounting element.
Step 2. Assign partners
Open the partner card (CRM and marketing → Partners) and in the "Access group" field select the created group. One partner — one access group. If the field is left blank, the partner falls into an "empty" group; who can see it depends on the settings, and such a counterparty can easily "fall out" of the view of all managers. Make sure new partners are assigned a group immediately upon creation.
Step 3. Grant rights
Master data and administration → User and rights setup → Access group profiles (or User access groups). For the desired profile, on the "Access restrictions" tab, for the access type "Partner groups," specify exactly which groups are allowed. Permission can be given as "All except…" or "Only listed."
Important. Until at least one partner is assigned to a group and the profile is configured, the restriction does not work — you have simply created empty catalog entries.
4. A worked example
A note upfront so you don't go looking for something that doesn't exist: the "Partner Access Groups" catalog does not generate postings and is not reflected in accounting registers. So the "example with postings" is an example of how the restriction affects work, plus the postings of the document that all this was set up to control.
Condition. An LLP under the general tax regime, VAT 16%. Two managers: Assel (wholesale) and Dana (retail). We create two groups: "Wholesale" and "Retail." VIP client LLP "Kagazy" is placed in a separate "VIP" group — visible only to the director.
Rights setup:
- profile "Wholesale Manager" → allowed group "Wholesale";
- profile "Retail Manager" → allowed group "Retail";
- profile "Director" → all groups allowed, including "VIP."
Result of the restriction. In the partner list and reports, Assel sees only wholesale clients. She will not find the partner "Kagazy" either by search or in the "Receivables" report — for her, it's as if it doesn't exist. Dana sees only retail. The director sees everyone.
Postings — by the sales document, not by the catalog. The director posts a sale to client "Kagazy" (group "VIP") for 1,160,000 ₸ with 16% VAT: goods 1,000,000 ₸ + VAT 160,000 ₸.
| Dr | Cr | Amount, ₸ | Meaning |
|---|---|---|---|
| 1210 | 6010 | 1,000,000 | Sales revenue, buyer's receivable |
| 1210 | 3130 | 160,000 | VAT payable (16%) |
| 7010 | 1330 | 620,000 | Cost of goods sold written off |
Assel will not see or be able to open this sale — the partner is in a group closed to her. This is exactly how the catalog "cuts off" unauthorized people from other people's sales, without generating any postings itself.
5. "Operation types"
Unlike a document, the catalog has no operation types. In practice it is meaningful in three scenarios:
- By department — each department sees its own clients.
- By confidentiality — VIP/special counterparties are visible only to a designated circle.
- By territory/channel — "Almaty Retail," "Wholesale for Kazakhstan," "Tenders."
6. What is generated upon saving
Honestly and to the point:
- No accounting postings. The catalog does not participate in the "Self-supporting" register etc.
- ESF and SNT are not issued. Electronic documents are generated by sales/receipt documents, not by this classifier.
- What actually changes — upon saving, a catalog element is created/updated, and when rights are configured, its values are placed in the information registers of the access restriction system. From that point on, queries for partners and related documents are automatically filtered by the groups allowed for the current user.
7. Printed forms
The catalog has no printed forms of its own. Standard list output is available: "More → Output list" (to file/print/spreadsheet document) — useful for agreeing the list of groups with the director. The matrix "who sees which group" is printed from the rights settings, not from here.
8. Common mistakes
"Insufficient rights to perform the operation on Catalog Partners" (or the partner simply cannot be found). Cause: the counterparty is in a group not allowed for the user's profile. Solution: check the "Access group" field on the partner card and the list of allowed groups in the profile. If an employee was transferred to another department — update their profile.
A new partner is not visible to anyone. The "Access group" field was not filled in, and the partner "got stuck" in an empty group. Fill in the field and configure who has access to the empty group (or forbid it for everyone, so such "groupless" entries immediately stand out).
"The item cannot be marked for deletion: it is referenced" when trying to delete a group. The group is referenced by partners or rights settings. Using "More → Related objects" / referential integrity control, find who references it, reassign the partners to another group, remove it from the profiles, and only then mark it for deletion.
The restriction "does not turn on." The "Restrict access at the record level" checkbox is not set, or the "Partner groups" access type is not enabled. Check the "Access restriction" section. After enabling RLS, the first login may be noticeably slower — rights are being rebuilt, this is normal.
9. FAQ
Why don't I have "Partner Access Groups" in the menu at all? Record-level access restriction is not enabled. Go to: Master data and administration → User and rights setup → Access restriction → check "Restrict access at the record level," then enable the "Partner groups" access type.
Does this catalog generate postings or ESF? No. It is an access classifier. Postings (1210, 6010, 3130 with 16% VAT) and ESF are generated by sales/receipt documents, and the catalog only decides who sees them.
Can a partner be in two access groups at once? No. A partner has one "Access group" field. To give access to several teams, add these groups to their profiles — the partner stays in one group, but the number of allowed profiles can be many.
What happens to a partner without an access group? It falls into the "empty" group. Visibility depends on whether the empty group is allowed in the profile. It is safer to always fill in the group.
How can I bulk-assign groups to partners already created? From the partner list: select the ones you need, "More → Change selected," the "Access group" attribute, set the value. This lets you quickly sort an old database by department.
Does the restriction apply to documents, or only to the partner card? To everything related to the partner: orders, sales, mutual settlements reports. If the partner is unavailable to you — you also won't see their documents.
Does the access group affect prices, discounts, or segments? No. For marketing there are partner segments and price groups — these are separate mechanisms. The "Access group" is only responsible for visibility rights.
Is the administrator also restricted by groups? A user with full rights usually sees everything. Restrictions apply to profiles where the "Partner groups" access type is set to "only listed." Check under the manager's own account, not the administrator's.
Can groups be made into a hierarchy (folders within folders)? In practice it is a flat list of access labels. Don't overcomplicate it: create as many groups as there are real "walls" between teams, otherwise you'll get confused when granting rights.
After enabling the restriction, the database became slower — is that because of the groups? Partly yes: RLS adds filtering to queries. Reduce the number of access types to the necessary minimum and don't multiply groups unnecessarily — this lowers the load.
10. Related objects
- "Partners" catalog — here the "Access group" field is set with a value from our catalog; without this link the group is useless.
- "Access group profiles" / "User access groups" — where you decide which partner groups are allowed for which profile.
- "Record-level access restriction" settings — the "switch" without which the catalog is not displayed.
- Sales/purchase documents (Sale, Customer order, Receipt) — these are exactly what the restriction applies to, and they are what generate postings (1210, 3310, 6010, 7010, 3130) and electronic documents (ESF in the ESF IS, SNT).
How to check your release. Help → About the program — there you'll find the platform version and configuration release.
This guide was prepared for "Trade Management for Kazakhstan" 3.4.5.21 (edition 3.4). When updating, check against your release in "Help → About the program."