Opening the book…
OWE · Lender AR
Every person belongs to one usage group, and the group decides which screens they can open. Change the group here; change what a group opens in the next table. A new person gets a temporary password — shown to you once, and emailed to them when the service's mail is set up — which they change at first sign-in.
You can see who has access; changing it needs “Access — change people and groups”.
Press a switch to cycle it: off → read → read + all its actions → off. Where a screen has several actions, each has its own toggle under the switch, and “part” means some of them. Save the row when it looks right; it applies to everyone in the group on their next request — nobody needs to sign out. A dashed ring marks a cell that differs from the group's defaults. Super admin always has everything and is not listed, and only a super admin changes the group they are in. Enforced on the server, so a read-only group cannot act even by calling the API directly.
Cash Management is separate from the usage groups: only the people listed here can open it, whatever their group — a super admin who is not listed cannot. Add a person with their @ourworldenergy.com address; it applies on their next request. They also need a sign-in (Who can open what, above) to open anything.
You can see who has Cash Management; changing it needs “Access — change people and groups”.
A financier login sees only its own financier's accounts and changes nothing. Pick its financier from the list — the names as the book spells them, which a login's scope is matched against exactly, so a login made from one always sees its accounts.