RBAC matrix

Generated from packages/auth/src/rbac.ts at build time. Cannot drift from code.

A check (✓) means the role has the action. The Product column tags whether an action is bound to one product (Payroll / Bookkeeping) or is product-neutral (client / template / staff admin surfaces).

Action	Product	CLIENT_SUBMITTER	CLIENT_APPROVER	PAYROLL_EXECUTIVE	PAYROLL_LEAD	BOOKKEEPER	SENIOR_ACCOUNTANT	ADMIN	PLATFORM_ADMIN	FS_PREPARER	FS_REVIEWER	XBRL_PREPARER	XBRL_REVIEWER	CORRESPONDENCE_OPERATOR	CORRESPONDENCE_REVIEWER
SUBMIT_INTAKE	PAYROLL	✓
APPROVE_PAYROLL	PAYROLL		✓
VIEW_CYCLE	PAYROLL	✓	✓	✓	✓			✓	✓
MANAGE_CYCLE	PAYROLL			✓	✓			✓	✓
RESOLVE_ISSUE	PAYROLL			✓	✓
GENERATE_EXPORT	PAYROLL			✓	✓
UPLOAD_OUTPUT	PAYROLL			✓	✓
REQUEST_APPROVAL	PAYROLL			✓	✓
OVERRIDE_ISSUE	PAYROLL				✓
VIEW_BATCH	BOOKKEEPING					✓	✓	✓	✓
MANAGE_BATCH	BOOKKEEPING					✓	✓	✓	✓
APPROVE_JOURNAL	BOOKKEEPING					✓	✓	✓	✓
GENERATE_UPLOAD_FILE	BOOKKEEPING					✓	✓	✓	✓
RECONCILE_BANK_TXN	BOOKKEEPING					✓	✓	✓	✓
OVERRIDE_JOURNAL_FLAG	BOOKKEEPING						✓	✓	✓
VIEW_FS_ENGAGEMENT	FINANCIAL_STATEMENTS						✓	✓	✓	✓	✓	✓	✓
MANAGE_FS_ENGAGEMENT	FINANCIAL_STATEMENTS						✓	✓	✓	✓	✓
UPLOAD_TRIAL_BALANCE	FINANCIAL_STATEMENTS						✓	✓	✓	✓	✓
CONFIRM_FS_MAPPING	FINANCIAL_STATEMENTS						✓	✓	✓	✓	✓
OVERRIDE_FS_MAPPING	FINANCIAL_STATEMENTS						✓	✓	✓	✓	✓
GENERATE_STATEMENTS	FINANCIAL_STATEMENTS						✓	✓	✓	✓	✓
RESPOND_DISCLOSURE	FINANCIAL_STATEMENTS						✓	✓	✓	✓	✓
GENERATE_NOTES	FINANCIAL_STATEMENTS						✓	✓	✓	✓	✓
EXPORT_FS_DOCUMENT	FINANCIAL_STATEMENTS						✓	✓	✓		✓
APPROVE_FS	FINANCIAL_STATEMENTS		✓
VIEW_XBRL_FILING	XBRL_FILING						✓	✓	✓			✓	✓
MANAGE_XBRL_FILING	XBRL_FILING						✓	✓	✓			✓	✓
INGEST_XBRL_DOCUMENT	XBRL_FILING						✓	✓	✓			✓	✓
CONFIRM_TAG_MAPPING	XBRL_FILING						✓	✓	✓			✓	✓
ADD_MAPPING_SYNONYM	XBRL_FILING						✓	✓	✓				✓
RUN_XBRL_VALIDATION	XBRL_FILING						✓	✓	✓				✓
EXPORT_BIZFINX	XBRL_FILING						✓	✓	✓				✓
EXPORT_XBRL_XML	XBRL_FILING						✓	✓	✓				✓
MARK_XBRL_FILED	XBRL_FILING							✓	✓				✓
APPROVE_XBRL	XBRL_FILING		✓
INGEST_CORRESPONDENCE	CORRESPONDENCE							✓	✓					✓	✓
CLASSIFY_CORRESPONDENCE	CORRESPONDENCE							✓	✓					✓	✓
REVIEW_CORRESPONDENCE	CORRESPONDENCE							✓	✓					✓	✓
MATCH_CORRESPONDENCE	CORRESPONDENCE							✓	✓					✓	✓
DISPATCH_CORRESPONDENCE	CORRESPONDENCE							✓	✓					✓	✓
MANAGE_CORRESPONDENCE_CONFIG	CORRESPONDENCE							✓	✓						✓
MANAGE_CLIENTS	—				✓		✓	✓	✓
MANAGE_TEMPLATES	—				✓		✓	✓	✓
MANAGE_STAFF	—							✓	✓
RUN_FINANCIAL_ANALYSIS	—				✓	✓	✓	✓	✓
VIEW_TAX_YEAR	TAX						✓	✓	✓
MANAGE_TAX_YEAR	TAX						✓	✓	✓
COMPUTE_TAX	TAX						✓	✓	✓

How to read this

• A role can perform an action across the platform if it has the cell checked.
• An action's product scope (when not —) means staff can only use it within that product. A Bookkeeper with MANAGE_CLIENTS (product-neutral) can edit any client; a Payroll Executive with VIEW_CYCLE (Payroll-scoped) cannot view bookkeeping batches even if the route doesn't 404.
• "Manage" actions imply read access; you don't need both VIEW_CYCLE and MANAGE_CYCLE together.