ERPNext permissions for Kraal workflows

Kraal reads ERPNext source records before it recommends or prepares work, and posts accounting documents you approve. If ERPNext blocks those reads or writes, Kraal surfaces the block instead of acting on partial evidence.

This guide covers the two permission sets the Kraal integration user needs: invoicing and payments (AR/AP) and inventory workflows.

Minimum access for invoicing and payments (AR/AP)

Kraal's invoices, bills, payments, statements, aging reports, and dunning workflows operate on these DocTypes:

ERPNext DocType	Minimum access	Why Kraal needs it
Sales Invoice	Read, Create, Submit, Cancel	List/inspect invoices, create and submit invoices and credit notes, statements, aging context.
Purchase Invoice	Read, Create, Submit, Cancel	List/inspect bills, create and submit bills and debit notes, duplicate checks, statements.
Payment Entry	Read, Create, Submit, Cancel	Record customer receipts and vendor payments with invoice allocations, including on-account remainders.
Journal Entry	Read, Create, Submit	Manual and recurring entries, reversals, close-item postings you approve.
Customer	Read, Create, Write	Customer search and quick-add, payment terms and credit-limit master data.
Supplier	Read, Create, Write	Supplier search and quick-add, payment terms master data.
Payment Terms Template	Read	Apply default terms to customers, suppliers, and documents.
Auto Repeat	Read, Create, Write	Recurring invoice/bill schedules (generated copies stay drafts for review).
Payment Reconciliation	Read, Write	Apply on-account credits to open invoices (also requires Payment Entry write, above).
Company	Read	Entity resolution, currency, and account qualification.
Account	Read	Chart-of-accounts mapping and report scoping.

Aging reports (Accounts Receivable / Accounts Payable) additionally require the integration user to run ERPNext's standard report engine (Report access on the involved DocTypes).

If a permission above is missing, the matching Kraal action fails with an ERPNext permission error and nothing is partially posted.

Provisioned automatically

For Kraal-managed sites these grants are applied automatically. Most rows are covered by the standard accounting roles assigned during client setup; Auto Repeat and Payment Reconciliation are granted through the Kraal-managed Kraal AR AP Automation role, which client provisioning creates and assigns on new sites and the access-repair action re-applies on existing sites. Manual Role Permission Manager steps are only needed for self-managed ERPNext instances.

When this applies

Use this guide when the Daily Board or Kraal says an inventory item is blocked by ERPNext source access, especially:

• Item Reorder cannot be read
• ERPNext returns a 403 or insufficient permission error
• Kraal says DocPerm admin access is needed
• inventory exceptions remain visible as source_unavailable

Recommended permission model

Kraal should not require blanket ERPNext administrator access for normal operation. The default model is:

1. Kraal detects the missing source permission.
2. Kraal explains the exact ERPNext DocType that is blocked.
3. An ERPNext System Manager grants the minimum required access.
4. The user rechecks the Daily Board in Kraal.

Only use Kraal-managed permission repair when your firm explicitly wants the Kraal integration user to manage ERPNext permissions. That requires elevated permission-administration rights and should be treated as an admin setup choice.

Minimum access for Item Reorder

For inventory exception monitoring, the Kraal integration user needs read access to:

ERPNext DocType	Minimum access	Why Kraal needs it
Item	Read	Identify active stock items and item defaults.
Bin	Read	Read on-hand and projected stock by warehouse.
Item Reorder	Read	Read reorder levels and reorder quantities.
Sales Order Item	Read	Detect demand and blocked fulfillment context.
Purchase Order Item	Read	Detect open replenishment already in progress.

If Item Reorder is blocked, Kraal cannot safely tell whether a low-stock item is truly below its reorder policy.

ERPNext admin steps

1. Sign in to ERPNext as a System Manager or another user allowed to manage role permissions.
2. Open Role Permission Manager.
3. Select Item Reorder as the DocType.
4. Select the role used by the Kraal integration user.
5. Enable Read permission.
6. Save the permission.
7. If your ERPNext instance caches permissions, clear the permission cache or sign the integration user out and back in.
8. Return to Kraal and recheck the Daily Board or ask Kraal to capture inventory context again.

Why DocPerm appears in the error

DocPerm is ERPNext's permission table. It controls which roles can read, create, edit, submit, report on, or export a DocType.

Kraal can sometimes repair missing permissions automatically, but only if the integration user is allowed to read and update the relevant DocPerm rows. If Kraal lacks DocPerm access, it cannot grant itself Item Reorder access. An ERPNext admin must make the change.

What Kraal will not do automatically

Kraal will not:

• grant itself broad administrator access by default
• submit stock entries from partial inventory evidence
• create purchase orders when reorder policy cannot be read
• hide the Daily Board item just because a context capture was attempted

After the permission is fixed, Kraal rechecks ERPNext source truth. The item clears only when the source read succeeds and the inventory exception is no longer present.