Checked on release 3.0.74.2 "Accounting for Kazakhstan" (version 3.0).
A new accountant has joined the department. You created a user for them, and they call: "I don't see any documents, the 'Post' button is greyed out." Or conversely — an intern opened the database and sees the director's salary and all three of your organizations at once. Both issues can be fixed in one place — in the directory "Access Groups". This is not about transactions or VAT. It's about who can see what in your database. Let's figure out how to assign rights so that everyone can do their job without interfering with others.
1. Purpose
The access group connects three participants in the process: users, profile (a set of roles — what can be done), and value restrictions (which organizations, warehouses, counterparties this can apply to). A user is added to a group — they receive rights. Removed — they lose them. This is the main working tool for the database administrator.
2. Where to find
Section "Administration" → "User and Rights Settings" → "Access Groups".
Nearby are "Users" and "Access Group Profiles" — they work in tandem.
A quick way to open the list directly: menu "Service" (or "Functions for Technical Specialist") → "Go to Navigation Link" and paste:
e1cib/list/Directory.AccessGroups
If the "Access Groups" section is not visible, it means there is one user in the database without a password and rights restriction has not yet been enabled. It can be enabled in "Administration" → "User and Rights Settings" by checking the box "Restrict access at the record level" (this is RLS — it creates tabs with restrictions by organizations and warehouses).
2a. How to find out your release
Menu "Help" → "About the Program". In the opened window, you will see two lines: platform version (for example, 8.3.24.x) and configuration release — "Accounting for Kazakhstan, version 3.0 (3.0.74.2)". The second number is your release. If it differs from the one mentioned above — the menu item locations may vary slightly, but the logic of the fields remains the same.
3. How to fill out
Open the list → "Create". Let's break down each field.
| Field | Purpose | What happens if you make a mistake |
|---|---|---|
| Name (mandatory) | The name of the group, by which you will find it: "Accountants of LLP Romashka", "Cashiers". | Cannot save empty. An abstract name like "Group 1" — and in six months you won't remember who it granted rights to. |
| Profile (mandatory) | The main field. The profile is a set of roles: "Accountant", "Cashier", "Payroll Specialist", "View Only". It determines which documents are visible and whether they can be posted. | Without a profile, the group is useless — it won't grant rights. If you select "Administrator" for an intern — they will gain full control over the database. |
| Participants (table part) | A list of users and user groups that receive this profile. Add using the "Select" button. | If you don't add a person — they won't receive rights, even if the user is created. |
| Participation period (in the participant's line) | You can set a date until which the participant remains in the group. Convenient for an auditor or temporary employee. | If you don't set it — access will remain forever until manually removed. |
| Access Restrictions (tabs by access types) | Appear only if restrictions are enabled in the profile and RLS is enabled in the database. Here you specify: "this group only works with LLP Romashka and the Main warehouse". Access types: Organizations, Warehouses, Counterparties, Individuals, Price Types, Financial Accounting Groups, etc. | If you leave "All except" with an empty list — the person won't see any organization. If you set "All allowed" — they will see everything, including what they shouldn't. |
| Comment | An explanation for yourself and fellow administrators. | Does not affect anything, but helps a lot when figuring out "who set this up". |
Logic of the restrictions tab. For each access type, there are two modes: "All except..." (by default, everything is available, you cross out the unnecessary) and "None except..." (by default, nothing is available, you list what is allowed). For a beginner, the second option is almost always the right choice: "None except" and explicitly specify the required organization/warehouse.
Summation rule. One user can belong to several groups. Rights accumulate: if one group allows organization A, and another allows B, the person sees both. You cannot revoke rights from a separate group — only not grant them.
4. Analyzed example
Task. In LLP "Romashka", three legal entities operate in one database. An accountant Asel has been hired. She should only manage LLP "Romashka", only for the "Main" warehouse, without access to payroll.
Steps:
- Create user Asel ("Administration" → "Users" → "Create"), set a login and password, check the box "Access to the program is allowed".
- Open "Access Groups" → "Create".
- Name:
Accountants — LLP Romashka. - Profile:
Accountant(it includes work with purchases, sales, bank, cash, but does not include payroll calculation). - Participants: "Select" → Asel.
- Tab "Organizations": mode "None except" → add
LLP Romashka. - Tab "Warehouses": mode "None except" → add
Main. - Save and close.
What Asel received. She enters the database and sees only documents of LLP "Romashka" for the "Main" warehouse. A sale of 3,480,000 ₸ with VAT 16% will be processed normally for her — Dr 1210 Cr 6010 for 3,000,000 ₸ of income and Dr 1210 Cr 3130 for 480,000 ₸ of VAT. However, she simply will not see the documents of the other two legal entities in the lists. The "Payroll" section is unavailable to her — the "Accountant" profile does not contain the payroll specialist roles.
Note: the access group does not create any transactions and does not calculate any amounts. It merely determines who is allowed to post the document that will generate those transactions. The numbers above illustrate what is now available to Asel, not the movement of the directory.
5. Types of operations (what the directory does)
This is not a document, so it has no "types of operations" in the accounting sense. Practically, the directory solves four tasks:
- Grant rights — add a user to a group with the required profile.
- Limit data scope — tie the group to specific organizations, warehouses, counterparties, individuals, price types.
- Provide temporary access — through the participation period.
- Revoke rights — remove a participant or close the participation period.
Separately, there is a predefined group "Administrators" with the profile "Administrator" — it cannot be left without at least one active participant.
6. What happens upon saving
The "Access Groups" directory does not generate accounting transactions and does not create electronic documents (ESF, CNT) — it is an object of the rights subsystem, not accounting. Upon saving, something else happens:
- Service information registers of the access rights subsystem (sets of access values, allowed values by access types) are updated. It is based on these that the platform dynamically decides which list rows to show to the user.
- The user is assigned roles that are part of the selected profile.
- Changes take effect upon the next login of the participant (sometimes — upon refreshing the list form). If the person is already in the database — ask them to log out and log back in.
7. Print forms and reports
There are no print forms (invoice, waybill) in the directory — there is nothing to print here. But there are reports for checking rights:
- "Access Rights" — shows all groups, profiles, and allowed values for the selected user. The main tool when figuring out "why they can't see".
- "Users" — a list of users with their access groups.
- "Access Groups" / "Participants of Access Groups" — a reverse slice: who is in a specific group.
They can be opened from the section "Administration" → "User and Rights Settings" → reports (button "Reports" or "More").
8. Common mistakes
"Access violation" / "Insufficient rights to perform an operation on the data". The user is trying to open or post a document that their group's profile does not allow. Check with the "Access Rights" report which group they belong to and whether the profile has enough roles. Often, adding the user to the correct group or expanding the profile helps.
The user logs in, but the document lists are empty. Classic: the restrictions tab is set to "None except", and the list is empty — meaning "nothing" is allowed. Add the required organization/warehouse or switch the mode.
"The access group 'Administrators' must have at least one user..." You are trying to remove the last administrator or revoke their access to the program. This would leave the database without an owner — the platform prohibits this. First, assign another administrator.
"The Profile field is not filled out". You cannot save a group without a profile — it won't grant any rights. Select a profile.
There are no restriction tabs (Organizations, Warehouses) at all. RLS is not enabled. Go to "Administration" → "User and Rights Settings" and check "Restrict access at the record level". Also, restrictions are only shown for those access types that are provided by the selected profile.
I changed the rights — nothing changed for the user. Rights apply upon login. Ask the employee to log out and log back into the database.
9. FAQ
What is the difference between an Access Group Profile and an Access Group? The profile is what can be done (a set of roles and access types). The access group is who this profile is granted to and with what restrictions on values (organizations, warehouses). One profile can be used in several groups.
How to give an accountant access to only one organization? In the group on the "Organizations" tab, select the mode "None except" and add the required organization. Requires RLS to be enabled and a profile that supports restrictions by organizations.
I added a user to the group, but they still see nothing. Why? Three common reasons: they did not log out and back in; the restrictions tab is set to "None except" with an empty list; the profile lacks the necessary roles. Check with the "Access Rights" report.
Can one user have multiple access groups? Yes. Rights from all groups accumulate. This is a normal way to combine: for example, "Cashier" + access to another organization.
How to temporarily grant access to an auditor? Add them as a participant and specify the participation period. After this date, access will be automatically revoked.
How to revoke access without deleting the user? Remove them from the group (or close the participation period). The user and their settings will remain, but they will lose rights.
Why can't I edit access groups? Only users with the "Administrator" profile can manage groups and profiles. A regular accountant does not see this section.
Does the access group create transactions or ESF? No. It is an object of rights delimitation. Transactions, ESF, and CNT create accounting documents (sales, receipts, etc.), while the group only determines who is allowed to work with them.
Can access be configured for external users (e.g., clients)? Yes, if external users are enabled in the database — separate profiles and access groups with external user roles are used for them.
How to check what rights the employee currently has? The "Access Rights" report for a specific user: it will show all groups, profiles, and allowed values in one place.
10. Related objects
- Access Group Profiles (
Directory.AccessGroupProfiles) — the source of roles. An access group always refers to a profile. If you change the composition of roles — edit the profile, not the group. - Users (
Directory.Users) — participants of groups. A user is first created, then included in a group. - User Groups — can be added to the access group as a whole, not one by one. Convenient for departments.
- User and Rights Settings — this is where RLS is enabled, without which restrictions by organizations and warehouses do not work.