# Bills, Payments & Your Team

## Bills: draft, post, pay

Vendor bills follow a deliberate two-step: anyone with edit access can
**draft** a bill (vendor, invoice number, lines, due date), but **posting**
it to the ledger requires the *controller* role or above. That separation is
optional in practice — a solo owner or a trusted bookkeeper can hold the
controller role and do both — but it's how larger teams keep entry and
approval in different hands.

Bills can also arrive automatically: emailed invoices are extracted into
drafts, and vendors with workflow rules can match incoming invoices against
commitments and even auto-approve within limits you set.

## Books roles

Each team member has a books role per entity (Settings → Entities):

| Role | Can |
|---|---|
| **Viewer** | Read everything |
| **Auditor** | Read + export, no changes |
| **Bookkeeper** | Categorize, draft bills and entries |
| **Controller** | Everything a bookkeeper can, plus post bills, approve, void |
| **Admin** | Everything, plus settings and connections |

If someone hits a "Forbidden" error doing something you want them doing,
their role is one tier too low — adjust it in Settings → Entities.

## Sharing a personal feed

Owners sometimes pay business expenses from a personal card that the
bookkeeper can't see. **Settings → Feed Sharing** (in the personal
workspace) grants read-only access to a single feed — the bookkeeper sees
that card's transactions and where each was assigned, and nothing else
personal. Revoke anytime.

## AI agents

If you or your accountant connect an AI agent (via the VisiBooks MCP
connector), it works under the same role system through API keys, every
action is attributed in the audit log, and journal entries it proposes wait
in the **Agent Queue** for human approval before anything posts.