People decide.Always two of them.
Anything the reader isn't sure of is flagged for a look, and nothing moves on one person's word: whoever enters a bill can't approve it, and whoever approves it can't pay it. Every rule is written to the audit trail as it's applied.
Fields to confirm
Priya
Entered it
Marcus
Approves it
- Seven rules, built inSeparation of duties, enforced
- Maker ≠ checkerWhoever enters it can't approve it
- Approver ≠ payerWhoever approves a bill can't pay it
- Every rule on recordPassed or waived, it's in the trail
How it works
Checked by one,approved by another.
The rules decide who can do what next, so nobody has to remember them.
- 01
Flagged
Values the reader is less sure of are marked, with the spot on the page lit up beside them.
- 02
Reviewed
The document and what was read, side by side. Fix anything; every change is recorded.
- 03
Approved, returned or rejected
A second person approves it, sends it back with a note, or rejects it with a reason.
- 04
Posted and paid
Posting and paying follow the same rules: the approver of a bill can't be the one who pays it.
The rules, applied
Nobody has to rememberwho's allowed.
thruflow checks the rules at the moment of each step and says plainly why something can't be done yet, and by whom it can. Passed or waived, each check is written to the audit trail.
- SOD-01: maker ≠ checker
- SOD-05: bill maker ≠ checker
- SOD-06: approver ≠ payer
- SOD-07: bank details ≠ approval
Maya enters BILL-2026-1042 · $4,210.00
Maya tries to approve it
Jordan approves it
Jordan tries to pay it
Priya pays it by ACH
SOD-01
Maker ≠ checker
Whoever submits an order can't approve it
SOD-05
Bill maker ≠ checker
Whoever enters a bill can't approve it
SOD-06
Approver ≠ payer
Whoever approves a bill can't pay it
SOD-07
Vendor master ≠ approver
Whoever changes bank details can't approve bills
What's in it
Strict by default.Sensible when you're small.
Roles that fit how you work
Submitters enter, approvers approve, finance posts and pays, admins manage people and prices. Each role's permissions are listed where you set them.
Bank details guarded
Changing where a vendor gets paid is a classic fraud route, so whoever can change vendor bank details can't approve bills.
Relaxed, still recorded
One or two people? Relaxed approvals let the same person do both steps, and the trail notes every rule that was waived.
Return with a note
Send it back to whoever entered it, with what to fix. Once it's fixed, it comes back for approval.
Stopped, and told why
When a rule stops a step, thruflow names the rule and what has to happen instead, in plain words, not a bare "access denied".
On the record
Every decision,kept for good.
Who entered it, who approved it and when, what they changed, and which rules were checked: all of it sealed into the audit trail, where nobody can edit it afterwards.