Checked on release 3.0.74.2 "Accounting for Kazakhstan" (version 3.0).
You have hired a new accountant, granted them access through the "Accountant" group, and they call saying, "I don't see documents for the second organization." You dive into the rights settings, start searching for restrictions, open the list of all directories — and stumble upon "Access Group Sets." The name is unclear, there are some lines with hashes inside, you want to edit it manually, but you're scared. Let's figure out: what is it, should you touch it, and how is it related to your accountant not seeing something.
1. Purpose
"Access Group Sets" is a service directory of the record-level security (RLS) rights limitation mechanism. It stores unique combinations of access groups that include users, so the program can quickly check which data to show to whom. This is internal "kitchen" of rights, not an accounting object: it does not provide entries, electronic invoices (ESF), or printed forms.
2. Where to find
This directory is not shown in the menu to regular users — it is a service directory. You can open it like this:
- Through the navigation link. Service command menu (☰ icon or "Main Menu") → "Service" → "Go to navigation link" → insert:
e1cib/list/Справочник.НаборыГруппДоступа - Through "All functions". Main menu → "All functions" → "Directories" → "Access Group Sets". If the "All functions" item is missing, enable it: "Service" → "Settings" → check "Show 'All functions' command".
- The rights mechanism that fills it lives in the "Administration" → "User and Rights Settings" section (access groups, profiles, organization restrictions).
You do not use a separate "Create" button in real work — entries appear automatically.
2a. How to know your release
"Help" (or ? icon) → "About the program". In the opened window, you will see two lines: the platform version (for example, 8.3.24) and the configuration release — "Accounting for Kazakhstan, version 3.0 (3.0.74.2)." The second line is your configuration release. It is important: the set of service directories and the logic of RLS change from version to version.
3. How to fill
The main thing to understand: this directory is not filled manually. It is formed and updated by the program itself when recalculating access rights — when you change the composition of user access groups, edit profiles, or organization restrictions. Therefore, "step-by-step for each field" here means "what you will see inside and what it means," not "what to write."
| Field / Element | What it is and why | What will happen if you interfere incorrectly |
|---|---|---|
| Name / Code | Technical identifier of the set (often a hash of the group combination). Needed by the program, not by you. | If you rename it — you won't change anything meaningful, but you will disrupt the automatic reconciliation during the next recalculation. |
| Table part with access groups | List of access groups that together form this set. This combination determines which records the user will see. | If you add/remove a line manually — the actual rights will not change (they are calculated from the user's access groups), but a desynchronization will occur. |
| Service attributes (key/hash of the set) | Ensure quick search for the required set when checking access to each database record. | Editing breaks the mapping and may slow down or distort the rights check. |
Conclusion: there are no mandatory fields for manual input here — because there is no manual input here. If you want to change what the user sees, go to "Administration" → "User and Rights Settings" → "Access Groups", and this directory will rebuild itself.
The exact composition of the form attributes may differ in different builds of the BSP platform (this is a version-specific detail and requires verification on your release), but the principle of "service, auto-filled" remains unchanged.
4. Analyzed example
This directory does not have and cannot have entries — it does not reflect economic operations. Therefore, we will show the example based on its actual role: how due to the access group set the accountant "does not see" documents, and how to fix it.
Situation. There are two organizations in the database: LLP "Aktobe-Stroy" and LLP "Astana-Logistic". The new accountant Akhmetova was granted:
- Access group "Accountant";
- Organization restriction — only LLP "Aktobe-Stroy".
What happens inside:
- The program takes the combination of Akhmetova's groups and creates (or finds) a set in the "Access Group Sets" directory — for example, set No. 147 = {Accountant}.
- This set is linked to the allowed value "Organization = LLP 'Aktobe-Stroy'".
- When opening the document journal, the program checks the organization for each line against set No. 147 — and shows only the documents of "Aktobe-Stroy".
Why Akhmetova does not see the second organization — this is correct: her set does not include access to "Astana-Logistic". To grant access, you add "Astana-Logistic" to her restrictions. The program rebuilds the set (set No. 203 = {Accountant} with two organizations appears), and documents from both companies become visible.
Entries for clarity — those that the accountant will see after gaining access, for example, for the sale of goods for 1,160,000 ₸ (VAT 16%):
| Operation | Debit | Credit | Amount, ₸ |
|---|---|---|---|
| Revenue recognized (with VAT) | 1210 | 6010 | 1,160,000 |
| VAT accrued 16% | 6010 | 3130 | 160,000 |
| Cost of goods written off | 7010 | 1330 | 700,000 |
| Payment received to the account | 1030 | 1210 | 1,160,000 |
The essence of the example: these entries are generated by the "Sale" document, and the "Access Group Sets" directory only determines whether a specific user will see them.
5. Types of operations
This directory does not have separate "types of operations" like documents. There are modes of operation of the mechanism in which it participates:
- Auto-creation of a set — upon the first appearance of a new combination of groups for the user.
- Reuse — if such a combination already exists, a new element is not created, referencing the existing one.
- Recalculation when changing rights — editing a profile or restrictions restructures the set's links to access values.
- Update when transitioning to a new release — when updating the configuration, sets may be rebuilt under the changed rights model.
6. What is formed during work
- No accounting entries.
- No electronic invoices (ESF), tax returns, or other electronic documents. This directory is not about document flow and taxes at all.
- Movements in the rights mechanism information registers — yes. Sets are linked to access value registers (sets of access values for directory and document records) and participate in calculating which database records are available to whom. It is these service records that ensure RLS.
7. Printed forms
There are no printed forms for this directory. It is a service directory, nothing is printed from it. If you need a report "who sees what," use the standard tools in the "Administration" → "User and Rights Settings" section: reports on user rights and access groups.
8. Common errors
"Insufficient rights to view the directory 'Access Group Sets'." You logged in as a regular user. The service directory opens only with administrator rights. Log in as a user with the "Administrator" profile.
"Object modification is prohibited" / edits are not saved. This is by design: the directory is filled automatically. Do not edit it manually — change the composition of user access groups in the rights settings, and the set will rebuild itself.
"User does not see documents of one of the organizations." The reason is not in this directory, but in the access group restrictions. Open "Administration" → "User and Rights Settings" → "Access Groups", check if the required organization is included in the allowed values. After saving, the set will update.
"After updating the release, the rights are 'off', users see extra or nothing." Run the data update of the information base to completion ("All functions" → "Standard" → "Manage results and update data" or restart with update handlers). Access group sets are recalculated in the background; wait for the completion of scheduled update tasks.
"Journals open slowly for users with restrictions." Check if the scheduled access update tasks are disabled. If the sets have not been recalculated, RLS works slowly. Enable tasks in "Administration" → "Maintenance" → "Scheduled and background tasks".
9. FAQ
Can elements be deleted from "Access Group Sets"? No. Manual deletion will lead to desynchronization of rights. Unnecessary sets are cleaned by the program itself during access recalculation.
Why are there more records in the directory than users? One set is a unique combination of access groups, not a user. Different combinations of groups yield different sets; plus, historical sets remain until cleaned.
I accidentally changed an element — what to do? Nothing critical. Run the access update (scheduled task) — the set will rebuild from the actual user groups.
Does this directory affect VAT, PIT, pension contributions, and other calculations? No. It only determines who sees which data. The VAT rate of 16%, PIT deduction of 30 MRP, and other norms of 2026 are calculated by documents and accounting registers, not here.
How to grant the accountant access to the second organization? Not through this directory. Go to "Administration" → "User and Rights Settings" → "Access Groups", add the organization to the allowed values. The set will update automatically.
Is it necessary to include this directory in the backup? It is already included in the database — no separate action is needed. When restoring a copy, it will be restored along with all data.
Why do I not see this directory in the menu at all?
It is a service directory and is hidden by default. Open it through "All functions" or the navigation link e1cib/list/Справочник.НаборыГруппДоступа under an administrator.
Can the overflow of this directory slow down the database? Not by itself — there are usually few sets. The slowdown is caused not by the directory, but by disabled access recalculation tasks or very complex restrictions. Check the scheduled access update tasks.
What to do if after updating the configuration the rights work incorrectly? Wait for the completion of update handlers and scheduled tasks. If it did not help — perform a full recalculation of rights through user and rights settings under an administrator.
10. Related objects
The directory is not introduced "based on" a document and does not generate anything itself. It is part of the rights subsystem and is related to:
- Directory "Access Groups" — sets are formed from their combinations.
- Directory "Access Group Profiles" — define roles and types of restrictions (by organizations, warehouses, counterparties).
- Directory "Users" — their group composition determines which set will be matched to them.
- Access value registers — store which specific values (organizations, etc.) the set applies to.
Change everything through "Administration" → "User and Rights Settings" — "Access Group Sets" will adjust themselves.
How to know your release. "Help" → "About the program": it indicates the version of the "1C:Enterprise" platform and the configuration release. This instruction is prepared for "Accounting for Kazakhstan", version 3.0, release 3.0.74.2. In other releases, the composition of service attributes may differ slightly, but the purpose of the directory remains the same.
Prepared for release 3.0.74.2 "Accounting for Kazakhstan" (version 3.0).