Roles and permissions

Bitta Commission controls access in two layers. Business Central permission sets decide which pages and actions a user can use. Commission user scopes decide which participants' records the user can see. This page describes both and suggests assignments that keep duties separate.

Scopes decide which participants each user can see.

Before you start

• A Business Central administrator assigns permission sets in the standard Business Central way, per user and company.
• A user with the Bitta Commission Setup Administrator permission set maintains commission roles and user scopes.
• Assigning a commission scope does not grant Business Central permissions. Every user needs both a permission set and, where relevant, a scope.

Permission sets

The app ships eleven assignable permission sets.

Permission set	Caption	Designed for
BAA Comm Setup Admin	Bitta Commission Setup Administrator	Company setup, the setup wizard, Excel imports, feature modules, license activation, organization structures, territories, templates, approval policies, notification and workflow setup, and user scopes.
BAA Comm Plan Dsgnr	Bitta Commission Plan Designer	Plans, Draft versions, components, rates, crediting rules, credit splits, assignments, quota targets and plan document distribution.
BAA Comm Processor	Bitta Commission Processor	Source capture, calculation runs, statements and day-to-day processing, including exceptions.
BAA Comm Approver	Bitta Commission Approver	Reviewing and deciding approval requests, such as plan versions, posting proposals, settlements and statements.
BAA Comm Accountant	Bitta Commission Accountant	Accounting policies, account mappings, posting setup, posting proposals, reconciliations, corrections and eligibility holds.
BAA Comm Payroll AP	Bitta Commission Payroll and AP	Settlements, payroll-ready exports, AP exports and payroll acknowledgements.
BAA Comm Manager	Bitta Commission Manager	A manager's view of the team: statements, disputes, holds, simulation and team approvals.
BAA Comm Participant	Bitta Commission Participant	A sales rep's own commission: plan acceptance, statements, disputes, and read-only access to their own earnings and calculation trace.
BAA Comm Auditor	Bitta Commission Auditor	Reading configuration, ledgers and evidence for audit.
BAA Comm Support	Bitta Commission Support	Reading configuration and evidence to diagnose problems.
BAA Comm Integration	Bitta Commission Integration	Staging source and organization data from other systems for import.

Least-privilege design

Most write access in these permission sets is indirect. Users change commission data only through the app's governed actions, such as Submit, Approve, Calculate or Apply, and never by editing ledger tables directly. Review roles such as Auditor and Support read configuration and evidence and hold no direct write access to commission tables.

A participant reads earnings, tier rows and the calculation trace only indirectly, through My Earnings, My Earning and My Calculation Trace. Those pages lock the rows to the user's own participant and are read-only.

Some actions are also checked in code. For example, only a user with BAA Comm Setup Admin can switch modules, activate the license, prepare commission number series or create the demo.

Commission roles

Commission Roles lists the business roles you can give users in a scope. Each role has a code, a version, effective dates, a status and four capability flags: Can View Amounts, Can Approve, Can Resolve Disputes and Can Post.

To create a role, choose New, enter its details, and save it as a draft or save and activate it. Choose Activate Role to activate a reviewed Draft role. Use New Version to change a role from a date without losing its history. A role must be active before it can be used in a scope.

Commission user scopes

Commission User Scopes links a Business Central user to a commission role and an organization scope for a date range. The scope limits which participants' records the user can see in scoped pages, such as statements, disputes and team views.

Scope	What the user can reach
Participant only	One participant, typically the user's own participant record.
Manager and descendants	The anchor participant and their descendants in a chosen manager hierarchy.
Finance (all participants)	All participants, for finance and payroll roles.

To add a scope:

1. Open Commission User Scopes and choose Add User Scope.
2. On Commission User Scope, select the User Name and a Role Code. Use New Commission Role if the role does not exist yet.
3. In Organization Scope, choose the Scope. For a participant or manager scope, choose the Participant No.. For a manager scope, also choose the Manager Hierarchy Code.
4. Enter the Effective Period and choose Save.

Saved scope history cannot be edited. To change access, add a new dated scope.

Some period actions also check the scope. For example, Mark Future, Open Early and Approve Results on Commission Periods require the finance-all scope.

Segregation of duties

The app enforces a second person for sensitive decisions:

• A plan version is approved by someone other than the requester (BAA-WFL-SELFAPPROVAL).
• Credit overrides, discretionary earnings, scorecards and vacant position credit payments are approved by a different user.
• An action that would break segregation of duties is refused with BAA-WFL-SEGREGATION.

With the core, a single-approver policy covers plan approval. The Advanced approvals module adds multi-stage approval, delegation and SLAs. See Approvals and notifications.

Recommended assignments

Person	Permission sets	Scope
Implementation lead	BAA Comm Setup Admin	Finance (all participants)
Compensation analyst	BAA Comm Plan Dsgnr	Finance (all participants)
Commission operator	BAA Comm Processor	Finance (all participants)
Plan or finance approver	BAA Comm Approver	Finance (all participants)
Accountant	BAA Comm Accountant	Finance (all participants)
Payroll or AP clerk	BAA Comm Payroll AP	Finance (all participants)
Sales manager	BAA Comm Manager	Manager and descendants
Sales rep	BAA Comm Participant	Participant only
Internal or external auditor	BAA Comm Auditor	Finance (all participants)

If you selected BC users in the setup wizard, assign the BAA Comm Participant permission set to them. The wizard creates the participant link, not the permission.

What to check if it goes wrong

Symptom	What to do
A sales rep sees no statements	Check the BAA Comm Participant permission set, the participant's primary user link, and a Participant only scope covering today.
A sales rep sees no earnings on My Earnings	Check the participant's primary user link or a Participant only scope covering today. My Earnings never shows team or finance scope rows.
BAA-RPT-MY-SCOPE	The user tried to open an earning that is not their own.
A manager sees no team members	Check the Manager and descendants scope, the hierarchy code and the effective dates. Reporting lines are maintained in the Commission Hierarchy Editor.
BAA-ORG-SETUP-AUTH	The action needs the Bitta Commission Setup Administrator permission set.
BAA-WFL-SELFAPPROVAL	Another user must approve the request.

Related pages

• Approvals and notifications
• Audit and security
• Participants and payees
• My Commission for sales reps