Data access

Access layers

Layer	Controls
Account	Whether the user can sign in and whether the account is active
Role	Which object types, menus, and actions the user can access
Organization scope	Which company, office, branch, or department data is available
Record state	Whether a draft, approved, posted, closed, or locked record can be changed
Field/action permissions	Whether sensitive fields or specific actions are visible/editable

Request access

State the business need

Identify the user’s role, responsibilities, office, required modules, and actions.

Obtain approval

Follow the organization’s user-access approval process.

Create or update the user

An authorized administrator maintains the account, roles, and scope.

Test the result

Confirm the user sees the required functions and does not see unnecessary privileged data/actions.

Retain evidence

Record approval, implementation, and verification.

If access is wrong

Missing menu: check module activation and role permission.

Missing record: check office/company scope, list filter, status, and object permission.

Disabled action: check role, selection, required source, approval/posting state, and period lock.

Excess access: stop using the unnecessary function and notify the administrator immediately.

Never solve an access problem by sharing credentials or assigning a broad administrator role without review.

Access layers