The edit screen is the other front door
We checked carefully who could create a supplier invoice and never checked who could change one. The edit screen is a second way in to the same record, and it is the one nobody audits.
When you think about who can touch a supplier invoice, you think about who can raise one. That is the front door, and it tends to be the one with the lock on it. The edit screen is a second door into the same record, and in our experience it is the one nobody checks.
We found this in our own code this week. Creating an invoice had been checked for well over a hundred releases: name a supplier that is not yours and it is refused. Editing one had never been checked at all. And editing is the easier route, because by then the record is already yours — you are not asking to touch somebody else's document, you are changing your own and quietly pointing it somewhere new.
Why the edit is the better door
Permission checks tend to be written where something is created, because that is where the thinking happens. By the time you are editing, the question feels settled — this is my record, I am allowed to be here. But an edit can change the very field that decides whose record it is. Change the supplier on an invoice and you have not edited an invoice; you have moved it into somebody else's books.
The version we drove in testing moved an invoice out of one business's ledger, marked it as paid, and dropped it into another's. The first business's list came back empty. The second's showed a payment they never made. No error anywhere.
The same shape in a venue
This is not only a software point. Ask yourself who can change a record in your venue, as opposed to create one. Who can edit a stocktake after it is counted. Who can change the covers on a closed day. Who can amend a timesheet after it is approved. Most venues can answer the "who can add" version of those questions immediately and have never once asked the "who can change" version.
The record of a change is worth as much as the record of the thing. Our general rule — archive, never delete — exists for the same reason: a figure that can be quietly altered is a figure nobody can rely on at year end.
What to take from it
When you set up permissions, walk every screen twice: once asking who can make this, once asking who can change it after the fact. The two answers should be deliberate, and they are often not the same answer.