Someone cannot perform an action: what do you check?

Someone cannot perform an action: what do you check?

A colleague needs to approve an invoice, confirm an order or block a card, but the button is missing or they get the message that they have no access. So what do you switch on? In this article we approach it from the other side: not which fields a role contains, but what you need to set up to let someone perform a specific action.

This article is intended for application administrators. Are you not an application administrator and is there something you cannot do? Then forward this article to your application administrator, together with the action you want to perform and the amount involved.

Access consists of four layers

Almost every question along the lines of 'why can a user not do this?' is caused by one of these four layers being overlooked. They work together: if one is missing, the action is not available.
  1. The role determines which components and actions someone has in principle. You set up roles via Application management / Organization / Roles. If you work with function profiles, those are collections of roles. An employee has one or more roles, per organizational unit.
  2. The right is the concrete authorization for a component or an individual action, for example unblocking a card or requesting a PIN. You manage rights via Application management / Organization / Rights. Without the right the button is not there, even if the page itself is visible.
  3. The procuration determines up to which amount someone may approve, and in which organizational unit. You set this up per module via Application management / Invoice processing / Procuration, Application management / Procurement / Procuration and Application management / Expense claims / Procuration. Rights alone are not enough: without an procuration amount someone will not appear in the approval flow.
  4. The status of the employee: active, not deleted, and with an active role. This is the layer that is forgotten most often, because there is no message about it. If you set an employee to inactive, they silently disappear from flows they were previously part of.

So always check in this order: role → right → procuration limit (amount and unit) → status of the employee → substitution. The question 'does he have the right?' is almost never enough.

I want someone to be able to do this: where do you set it up?

Cash & Card

  1. Temporarily blocking a card, unblocking it, changing the PIN or requesting the PIN: these are four separate rights. So someone can, for example, block but not unblock. In addition, the card book must be part of the employee's role. See Roles, rights and function profiles for Cash & Card and Standaard rechtenset Kas & Pas (Dutch).
  2. Reviewing bookings: the right to review, plus authorization for the relevant book.
  3. Closing a period: this is a separate setting on the role, independent of reviewing. Someone who may review is therefore not automatically allowed to close.
  4. Exporting bookings: right for Cash & Card / Export, and the export mapping must be set up.

Invoice processing

  1. Coding or approving invoices: right for the relevant component, plus an procuration limit for the amount of the invoice. See Setting up procuration limits for Invoice processing and Standaard rechtenset Factuurverwerking (Dutch).
  2. Exporting invoices: right for Invoice processing / Export. In addition, the invoice must have the status approved, ready for export and must not already be part of an export in progress.
  3. Marking an invoice as exported: this is a separate right for the manual export action. Grant it very selectively: with this action someone can set an invoice to exported without the booking being present in your financial package.
  4. Managing the export mapping or the export schedule: separate administrator rights, to be set up via Application management / Invoice processing / Export mapping and Application management / General / Export schedule.

Procurement

  1. Approving or confirming an order: right for the component, plus an procuration limit for both the amount and the organizational unit of the order. See Procurement procuration levels and Standaard rechtenset Inkoop (Dutch).
  2. Completing or cancelling an order: right for Procurement / Complete. In addition, the order must have a status in which this is still allowed.
  3. Reviewing suppliers and reviewing receipts: two separate rights.
  4. Using a webshop (OCI): right for Procurement / Catalog, and the webshop must have been made available to the employee. If someone does not see the webshop or supplier, What can I check as an application administrator if a requester does not see the desired supplier(s)? will help.
  5. Managing webshops: administrator right for Application management / Procurement / Available webshops.

Would you rather start from an existing set? Then have a look at the default rights sets and adjust those, instead of building a role from scratch. With function profiles you keep that manageable afterwards.

Procuration: amount and organizational unit

An approver only appears in the approval flow if all of these conditions are met:
  1. their procuration amount is equal to or higher than the amount that needs to be reviewed;
  2. the employee is active and not deleted;
  3. the employee's role is active and not deleted;
  4. the employee is in the same organizational unit or in a higher-level unit;
  5. for orders, the requester themselves cannot be selected as the reviewer.

That explains the four situations we see most often when someone is 'not in the list':
  1. The amount is too low. Procuration is a limit, not a permission: below that amount someone may approve, above it they may not.
  2. The wrong organizational unit. Procuration work upwards in your structure, not sideways. Someone from a sister department will never appear in the flow, regardless of their amount. Check the unit via Application management / Organization / Structure.
  3. The employee or their role is inactive. The approver then disappears from the flow, without any message.
  4. The requester is the intended reviewer. For orders they are deliberately excluded, so there must always be someone else in the flow.

Does a requester get a message about the procuration scheme when submitting an order? Then it is almost always one of these four. See An error message about the procuration scheme when submitting an order.

Substitution: what it does and does not do


A substitute takes over tasks from an absent colleague, and for invoices you can see in the history that an action was performed by a substitute. Important to know: a substitute does not automatically take over everything the absent colleague can do. Substitution works per component, and it is exactly that misunderstanding that leaves an order pending while the substitution has 'already been set up'.

If a substitution does not seem to work, check the following:
  1. has the absence been recorded with the correct period, and has the end date not yet passed? After the end date the substitution expires;
  2. is the substitute themselves active and do they have the role and the right for the action;
  3. for approvals, does the substitute have a sufficient procuration limit of their own? A substitution does not replace an procuration amount.

You can read how to record a substitution in Filling in for absent colleagues.

The message 'No access to this component'


This message does not say which right is missing. So work through the four layers in the order above: role, right, procuration, status of the employee, and after that substitution. In practice, nine times out of ten it is the right for the component or the organizational unit.

Please note! When completing or cancelling orders this message can also appear while the rights are set up correctly. If the four layers are in order and the message keeps appearing, do not keep searching in the configuration, but contact support.

Useful to know: in Application management / Organization / Audit log you can see changes to roles and rights. If something 'still worked yesterday', start there.

Further reading

  1. Roles and Rights
  2. Permissions and roles within the Spend Cloud
  3. Default rights
  4. Function profiles and roles
  5. Employee and role import
  6. What does the status of an invoice, order or export mean?

Still stuck? Then contact support via support@spend.cloud. Mention the name of the employee, the action they want to perform and the amount: then we can look into the configuration with you straight away.