Matriz de acessos

Who sees what — all at once. Screens in the rows, access groups in the columns, and in each cell the verb: V = view; +I, +A, +E = create, edit and delete. An empty cell = that group doesn't see that screen.

Who sees what, on a single page: screens in the rows, groups in the columns and the verb in each cell. It's where the screen nobody sees and the verb granted by mistake jump out. Read-only — granting stays on the Access screen. — this is the role of the "Access matrix" screen within the platform.

Three patterns make the visit worthwhile: a group with action verbs (+A/+E) on money screens it doesn't need to edit; screens of an entire module with no V at all (a module bought and not distributed); and the E verb (delete) outside the administrative groups.

In the cell, V means the group sees the screen; the letters after the + sign are the action verbs granted beyond view. The filter at the top narrows the matrix by screen name as you type, and the "only unreachable" button hides what's healthy to leave only the red rows on screen — the screens no group can open. The summary alongside shows how many screens, how many profiles and how many unreachable ones the current snapshot contains.

A screen in red is a screen NO group sees — a paid feature nobody can open. The "Only unreachable" button filters straight to them. The fix lives on the Access screen: grant view to the right group.

The matrix is an AUDIT. Granting and revoking still happen on the Access screen, which has the guards (last administrator, native group, idempotence). A clickable grid would redo each of those paths without the guards.

Exactly the same ones the Access screen manages: this company's groups, the tenant's (which aren't tied to a CNPJ) and those of sister companies in the same account. Until 13/09/2026 the matrix used a narrower slice and left out every group without a company — in many accounts that zeroed the columns and the screen answered "Nothing to show", as if the filter were wrong. Auditing by one slice and granting by another is the defect this rule closes: what you see here is what that screen grants.

Type and the matrix narrows by itself, without a button. It searches by the screen's name, by the menu group it appears in and by its address — and ignores accents: "inspecao" finds "Inspeção". If it comes back empty, the term really doesn't exist in the tenant's screen catalog; platform and technical screens are left out of this matrix on purpose, because their audience is the platform team.

Red is the screen NO group sees — unreachable: a feature the account pays for and nobody can open. It's the No. 1 finding the matrix exists to expose, and the "Only unreachable" button filters just those. Granting and revoking remain on the Access screen, which has the guards (last administrator, native group, idempotence). A clickable matrix would reintroduce each of those paths without the guards, and an audit that edits stops being an audit.