How to Prevent AP View Role/Privilege from Editing Invoice Distributions During Approval Workflow?

Summary:

We use the AP Inquiry /View role / ORA_AP_PAYABLES_INVOICE_INQUIRY_DUTY privilege which is designed to provide view‑only access to the invoice module. However, we’ve identified an issue: if these users are listed as an approver on an invoice, they gain the ability - through the BPM Actions menu - to edit invoice distributions during the approval workflow. This means they can modify invoice details, and those changes can move through the approval process without any audit trail indicating who made the updates.

Has anyone successfully implemented automated controls to monitor this or successfully adjusted the role/privilege to ensure users maintain invoice view‑only access while also preventing them from updating distribution details during invoice approval workflows?