Permission Matrix

This matrix covers the operator workflow checked for MHPAY-29. Permissions are scoped by organization/location through UserRoleAssignment.

Role mapping:

• Admin is the legacy alias for MegaAdmin.
• Operator is the legacy alias for PaymentOperator.
• Manager is represented by the implemented MegaManager role. There is no separate seeded Manager role.
• Viewer is read-only.

Workflow area	Action	Backend permission / policy	Admin / MegaAdmin	Accountant	Operator / PaymentOperator	Manager / MegaManager	Viewer	Frontend visibility	Backend expected result	Notes
Bank imports	View bank imports	location.bank_statements.view / bank_statements.view	Yes	Yes	Yes	Yes	Yes	Show imports/list routes	200 in allowed scope	Read-only for Viewer.
Bank imports	Upload bank statement	location.bank_statements.upload / bank_statements.import	Yes	Yes	Yes	Yes	No	Show upload route/actions only with upload permission	403 for Viewer	Quota may still block upload.
Bank imports	View Quality report	location.bank_statements.view / bank_statements.view	Yes	Yes	Yes	Yes	Yes	Show report tab/link with import view permission	200 in allowed scope	Same read permission as import detail.
Bank imports	Confirm/reject duplicates	location.transactions.match	Yes	Yes	Yes	Yes	No	Show duplicate decision buttons only with match permission	403 for Viewer	Treated as transaction review mutation.
Matching	Manual counterparty matching	location.transactions.match / counterparty.match	Yes	Yes	Yes	Yes	No	Show match action only with match permission	403 for Viewer	Scoped to transaction location.
Matching	Create matching rules	location.counterparties.manage / counterparty.match	Yes	Yes	Yes	Yes	No	Show create-rule action only with match/manage permission	403 for Viewer	Rule inherits transaction location.
Matching	Manage rules directory (edit/deactivate/activate)	location.counterparties.manage	Yes	Yes	Yes	Yes	No	/counterparty-rules write actions	403 without manage permission	List readable with counterparty.match; writes audited.
Allocations	Preview allocation	location.allocations.prepare / payment.allocate	Yes	Yes	Yes	Yes	No	Show preview route/actions only with prepare permission	403 for Viewer	Does not write to Syrve.
Allocations	Confirm allocation	location.allocations.confirm / payment.confirm	Yes	Yes	Yes	Yes	No	Show confirm button only with confirm permission	403 for Viewer	Prepares allocation for approval/queue.
Allocations	Approve allocation	location.payments.approve / payment.allocations.approve	Yes	Yes	No	Yes	No	Show approve action only with approve permission	403 for Operator/Viewer	Approval is accountant/admin workflow.
Syrve documents	View Syrve documents	location.payments.view / syrve.documents.view	Yes	Yes	Yes	Yes	Yes	Show document routes with document view permission	200 in allowed scope	Current compatibility maps document view to payment view.
Syrve documents	Start sync	organization.documents.sync / syrve.documents.sync	Yes	No	No	Yes	No	Show sync buttons only with sync permission	403 for Accountant/Operator/Viewer	Admin/manager operation.
Syrve postings	Queue posting	location.payments.queue / syrve.postings.queue	Yes	Yes	No	Yes	No	Show queue button only with queue permission	403 for Operator/Viewer	New posting starts in ApprovalRequired; all business/transport safety controls still apply.
Syrve posting rules	View/preview rules	location.payments.view / syrve.postings.view	Yes	Yes	Yes	Yes	Yes	Show rules preview/read-only where posting view is available	200 in allowed scope	Preview does not queue or write Syrve/iiko.
Syrve posting rules	Create/update/disable rules	location.payments.queue / syrve.postings.queue	Yes	Yes	No	Yes	No	Show rule management only with queue permission	403 for Operator/Viewer	Rules are scoped; no platform-global posting rules.
Syrve postings	Approve posting	location.payments.approve / syrve.postings.approve	Yes	Yes	No	Yes	No	Show approve button only with approve permission	403 for Operator/Viewer	Approval-only action.
Syrve postings	Retry/reconcile posting	location.payments.retry / location.payments.reconcile	Yes	Yes	No	Yes	No	Show retry/reconcile only with respective permissions	403 for Operator/Viewer	Reconcile is accountant/admin workflow.
Audit	View audit log	organization.audit.view / audit.view	Yes	Yes	No	Yes	Yes	Show audit route with audit permission	200 in allowed scope	Non-platform users see scoped/self audit only.
Anomalies	View anomalies	location.anomalies.view / payment.anomalies.view	Yes	Yes	Yes	Yes	Yes	Show anomalies route with anomaly view permission	200 in allowed scope	Viewer can read only.
Anomalies	Acknowledge/resolve anomalies	location.anomalies.manage / payment.anomalies.manage	Yes	Yes	No	Yes	No	Show anomaly action buttons only with manage permission	403 for Operator/Viewer	Critical anomaly handling is accountant/admin workflow.

Seed Profile Expectations

Role	Expected profile
MegaAdmin / Admin	All scoped permissions.
MegaManager	All scoped permissions except future production write approval. Used as current Manager mapping.
PaymentOperator / Operator	Upload/view bank statements, view quality reports, match counterparties, create counterparty matching rules, preview and confirm allocations, view Syrve documents/postings/anomalies. No approve, queue, retry, reconcile, sync, audit, posting-rule management, user/settings management.
Accountant	PaymentOperator banking workflow plus allocation/posting approve, queue, retry, reconcile, anomaly manage, audit view.
Viewer	Read-only imports, quality reports, transactions, allocations/documents/postings, anomalies, notifications, audit. No mutations.

403 UX

Backend scoped denials return 403 with permission_denied_for_scope and the operator-facing message Нет доступа для указанной области. Frontend direct-route permission checks show a clear no-access page instead of exposing unavailable actions.