Verified on release 3.4.5.21 "Trade Management for Kazakhstan" (edition 3.4).
A new manager starts work, logs into 1C — and sees documents of all organizations, all warehouses and purchase prices they shouldn't see. Or the opposite: an accountant clicks "Post" on a sales document and gets a red "Access rights violation". Both are fixed in one place — the "Access Groups" catalog. Here you decide who among users sees what and can do what. Below is how it works and how to set it up without "full access for everyone".
Let me clarify right away, so you don't search in vain: this is an administration object, not an accounting document. It doesn't create Dt/Ct postings, doesn't generate ESF or SNT, and doesn't calculate any amounts, VAT rates (in 2026 — 16%) or MRP. It only distributes rights. That's why the "example" below is an access setup, not a tax calculation.
1. Purpose
An "Access Group" links users with an access group profile (a set of roles) and with value restrictions (which organizations, warehouses, partners, price types a person is allowed). The profile answers the question "what can be done", the access group — "who gets it and within what boundaries".
2. Where to find it
- Menu:
Master Data and Administration→ blockUser and Rights Settings→Access Groups. - Nearby you'll find
Access Group ProfilesandUsers— you'll be opening these in tandem. - From a specific user's card:
Access Rights— there you can see which groups they're already included in, and add them to a new one from there.
1C navigation link: e1cib/list/Справочник.ГруппыДоступа
Copy it and open it via Tools → Go to navigation link (or File → Open by link) to get straight to the list.
The catalog is hierarchical — groups can be organized into folders. There is a predefined group "Administrators": it cannot be deleted, and at least one active user must always remain in it.
2a. How to find out your release
Help → About. In the window that opens: at the top — the platform version (e.g. 8.3.24.xxxx), below — the configuration release (in your case "Trade Management for Kazakhstan", edition 3.4, version 3.4.5.21). If you have a different version, some field labels and the set of access types may differ by one or two points.
Before setting up value restrictions, enable the mode:
Master Data and Administration→User and Rights Settings→ checkbox "Restrict access at the record level". Without it the "Access Restrictions" tab won't work, and you simply won't see any separation by organizations/warehouses.
3. How to fill it in
The access group card consists of a header and two tabs — "Members" and "Access Restrictions".
| Field | Required | Why, and what happens if it's wrong |
|---|---|---|
| Name | Yes | How the group appears in the list. Write it meaningfully: "Sales Managers — Romashka LLP", not "Group 1". Otherwise in six months you won't remember who it was given to, and you'll hand out extra rights. |
| Profile | Yes | A link to Catalog.AccessGroupProfiles. Determines the entire set of roles (what can be opened, created, posted). Get the profile wrong and the person either won't be able to work or will get too much. The profile also sets the composition of access types: which restrictions you'll be able to configure on the second tab. |
| Group (folder) | No | Where to place the item in the hierarchy. Doesn't affect rights, only ordering in the list. |
| Comment | No | Who created the group, why, and on what request. An empty comment is a source of future disputes about "who granted this". |
"Members" tab. Here you add users (Catalog.Users) and, if desired, user groups. One user can belong to several access groups — then their rights are combined (the principle "allowed if allowed in at least one group" applies). If a person is not in the member list of any suitable group — they won't have any rights.
"Access Restrictions" tab. Appears only if record-level restriction mode is enabled and the profile uses access types. For each access type (Organizations, Warehouses, Partners, Price Types, Company Cash Registers, Agreements, Partner/Item Access Groups, etc.) you select one of the modes:
- All denied, except those listed below — a "whitelist". This is usually how it's set up: allow exactly what's needed.
- All allowed, except those listed below — a "blacklist". Convenient when you need to close off one or two items.
Below, in the values table, you add the specific organizations/warehouses/partners to which the mode applies. An empty whitelist = no access at all. This is therefore the most common cause of "nothing visible".
4. Worked example
Task. The database has three organizations; two sales managers should work only with Romashka LLP and only with the main warehouse, and must not see purchase prices.
Since there are no postings here, the "result" is a specific setup, not Dt/Ct. Here's how it's done:
Master Data and Administration→ enable "Restrict access at the record level".Access Groups→ Create.- Name:
Sales — Romashka LLP (main warehouse). - Profile:
Sales Manager(standard profile). It grants rights to customer orders, sales documents, invoices — without access to purchasing or settings.
- Name:
- "Members" tab → add
Ivanov I.I.andPetrova A.A.. - "Access Restrictions" tab:
- Access type Organizations → mode "All denied" → add
Romashka LLPto the values. - Access type Warehouses → mode "All denied" → add
Main Warehouseto the values. - Access type Price Types → mode "All denied" → add only
RetailandWholesale(don't add the purchase price type — this way the manager won't see it).
- Access type Organizations → mode "All denied" → add
- Save and close.
What happens in practice. Ivanov opens the "Sales of Goods and Services" list and sees only Romashka LLP documents. In a new order, the "Organization" field is preset/selectable only as "Romashka", the warehouse — only "Main". The purchase price type is hidden for him in the item card. Same for Petrova. Rights take effect after the group is saved and access keys are updated (usually seconds; if the database is large, the background job may take longer).
If tomorrow the managers are also moved to "Store No. 2" warehouse — you don't create a new group, you just add a line to "Access Restrictions → Warehouses".
5. Configuration modes (analog of "operation types")
The catalog doesn't have "operation types" in the sense of a document, but it has modes that completely change behavior:
| Mode / technique | What it provides |
|---|---|
| Supplied profile | Roles are fixed by the manufacturer, cannot be changed — only selected in the group. |
| Profile copy | You copy a standard profile and configure your own set of roles and access types. |
| All allowed | Full access by type, except exceptions (blacklist). |
| All denied | Access only to what's listed (whitelist). |
| Members = user group | Rights are granted to an entire department at once; add a person to the department and they get the rights automatically. |
| Several groups for one person | Rights are summed — this is how "manager + report access" is put together. |
6. What happens on save
This catalog does not generate Dt/Ct postings, ESF, or SNT — it's not about money. When an access group is saved:
- service rights registers are updated (access value sets, group membership composition);
- access keys are recalculated — the platform uses them on the fly to decide whether to show a user a row/document or not (RLS);
- changes are applied to current and future sessions of member users.
This is why sometimes the right "arrives" not instantly, but after the user reloads the list or logs back in.
7. Printed forms and reports
The access group has no printed forms (like an invoice or a tax invoice). For control, use the rights subsystem reports:
- Access Rights (a report by user: which groups they belong to, which profile, which roles and restrictions) — called from the user's card or from the administration section.
- Access Groups — list of groups with profiles and members (standard catalog list output:
More→Output list). - User Actions Report / Event Log — who changed the group composition and when.
8. Common errors
"Insufficient rights to perform the operation on the data" / "Access rights violation" Either the user isn't a member of the required group, or in "Access Restrictions" the needed organization/warehouse hasn't been added to the whitelist. Check the "Members" tab and the values by access type.
User doesn't see the needed organization even though the profile is correct Classic whitelist issue: mode is "All denied", and that organization isn't in the values. Add it, or switch to "All allowed".
"Profile is supplied and cannot be modified"
Standard profiles cannot be edited. Click More → Create profile copy, edit the copy, and use it in the group.
The "Access Restrictions" tab doesn't appear
The Restrict access at the record level mode is not enabled. Enable it in the user and rights settings.
"The last user of the Administrators group cannot be deleted" / login left without an administrator The database cannot be left without an active administrator. First add another user to "Administrators", then remove the previous one.
Rights did not apply immediately Access keys are recalculated in the background. Have the user reload the list (F5) or log back in; on a large database, let the background job finish.
9. FAQ
(see FAQ block)
10. Related objects
Catalog.AccessGroupProfiles— the access group is created based on it; the profile defines roles and the list of access types. You should almost always start with this one.Catalog.UsersandCatalog.UserGroups— those you enter into the members.- Restriction values —
Catalog.Organizations,Catalog.Warehouses,Catalog.Partners,Catalog.PriceTypes,Catalog.CompanyCashRegistersetc.: these you select in the "Access Restrictions" tab. - "Access Rights" report — verification of the setup result.
How to find out your release
Help → About: at the top is the 1C:Enterprise platform version, below is the configuration release. The instructions are current for "Trade Management for Kazakhstan", edition 3.4, release 3.4.5.21. On other releases, the set of access types and field labels may differ slightly.
Material prepared for 1C:Trade Management for Kazakhstan, edition 3.4, release 3.4.5.21.