Week 6 of 8
Roles and permissions
If your testers run as an administrator, you have tested the software, not your security. The first day of go-live is then the first day anyone tries to post an invoice as an AP clerk.
Roles also change after go-live. New features arrive with new permissions, and Sage Intacct’s own release-readiness checklist tells customers to review permissions and roles before every release.
This week: build a role and permission test matrix
- List your business roles and the tasks each must do. Map them to the ERP’s security objects (roles, groups, permissions).
- Write a positive test (can do the job) and a negative test (cannot do what they should not) for every role.
- Add segregation-of-duties pairs: create vendor and pay vendor, enter and approve journal, change price and approve order.
- Run UAT with one test user per tester on production role assignments, never a shared admin login.
- Re-run the matrix after every release that touches security or adds a feature your users will see.
Number of the week
4 a year
Sage Intacct releases, applied to every customer automatically. Sage’s checklist for each one includes reviewing permissions and roles.
Source: Sage Intacct Help, What’s new in Sage IntacctUse this week
- ERP Role & Permission Test Matrix →
Roles, positive and negative tests, SoD pairs and a per-release re-test log, with coverage counts.
- Defect Severity & Triage Matrix →
Shared severity definitions so a blocked role is triaged the same way every time.
Next week: SIT, UAT and the go/no-go call. What the room needs to see before anyone signs.
Get the playbook in your inbox, one week at a time
Subscribe free and every template in the library is yours.