AccountedPro - Recipes

Build these in the Access Rule Builder and verify with the Access Simulator.

“It's mine” — owner sees their own records

Door → profile Full → scope: Owner · owner = @me.

My team's records (reports-to)

Scope: Reports-to hierarchy · owner in my reporting subtree — or a Field condition with the reports to me operator on a user field.

My department's records

Scope: Department · owner in my department.

Read-only for everyone, edit only for the owner

Two doors, Best access wins:

• Door A — profile Read-Only, scope empty (all rows).
• Door B — profile Full, scope owner = @me.

The owner gets the union (Full on their own, Read-Only elsewhere).

Closed / archived records become read-only or blurred

Door → profile Read-Only (or Blurred) → scope:

AND
├─ Field · status · equals · Closed
└─ Age · modified · older than · 3 months

Put it above a Full door and use First match wins so the archive door shadows full access.

AR user: sees all invoices of a customer with any balance

On Sales Invoice, door → Read-Only → scope:

AND
├─ Field · docstatus · equals · 1
└─ Linked record · EXISTS in Sales Invoice where its customer = this customer
                   matching: outstanding_amount not equals 0

This invoice's customer has at least one non-zero-balance invoice — so every invoice of a customer-with-a-balance shows. (Use not equals 0, and the field is outstanding_amount — equals 0 would match paid invoices, i.e. almost everyone.)

A record only if I can see its (dynamic) linked doc

On a Dynamic Link related_document + related_document_type:

Field · related_document · I have access to (linked doc) · read
      · on: from field related_document_type · matching name

One condition, every related-document type.

Scoped to specific accounts (scanners, kiosks) without hiding from everyone else

AND
├─ Current user is · in · scan01@x, scan02@x, kiosk@x
└─ Field · stage · not equals · Created

People outside the list are simply not affected by this door — it neither grants nor restricts them. Add a separate door for regular users.

Discover but not read (record exists, contents hidden)

Door → profile Discover-only (or Blurred). The record shows in lists/counts; opening it shows the blurred view and a Request Full Access button (if requests are enabled).

Mask a sensitive field, show only the last 4

Access Profile → field rule: policy_number → Masked → show last 4 → ••••••1234. On a Blurred door these rules describe the post-approval view.

Hide attachments behind a limited view

On the door, tick Block attached files — downloads are guarded server-side, not just hidden. Files referenced only by a hidden child row are blocked automatically.

Browse-by-customer but not the whole list

Tick Hide on list — the unfiltered list hides the door's rows; filtering by a customer reveals them; direct URLs still work.

Push a workstation's access onto its labels

On the Workstation rule → Cascade → target Production Label via workstation — choose Gate (labels visible only if their workstation is), Grant (seeing the workstation unlocks its labels), or Inherit (a label's access equals its workstation's). See Cascade and link guards.

Next: Enforcement and security.