Core Components of BAQ Security
BAQ security operates alongside user accounts, security groups, menu permissions, and the permissions associated with the underlying business data. The exact controls available depend on the Epicor product version, deployment, and configuration. Administrators should verify how each control behaves in their environment instead of assuming that query access automatically grants or restricts every underlying record.
- User and group permissions: Assign access according to job responsibilities, such as accounts payable, purchasing, financial reporting, or system administration.
- Query ownership and maintenance: Define who can create, edit, share, and maintain BAQs used for business reporting.
- Menu and application access: Control which users can open the screens, dashboards, and reports that expose query results.
- Data-level authorization: Verify that company, site, and transaction-level access rules are enforced wherever applicable.
- Audit and change tracking: Maintain appropriate records of permission changes, query modifications, and access reviews where supported.
These components serve different purposes. Permission to run a query, permission to edit its design, and authorization to view the underlying records should be assessed separately.
How Epicor BAQ Security Works
An administrator typically begins by identifying the business purpose of a BAQ and the information it returns. The administrator then reviews the query's ownership, sharing settings, execution context, associated application access, and applicable data permissions. Testing with representative user accounts confirms that the intended employees can retrieve the required results.
Consider a BAQ that reports supplier invoices, invoice dates, outstanding balances, and payment status. Accounts payable staff may need these fields to prepare payment runs, while other employees may only require supplier names and summary totals. Access should reflect these different responsibilities, using supported application and data controls rather than relying solely on the visibility of a report.
When reviewing a BAQ, examine the selected columns, joined tables, calculated fields, and filters. A query that joins invoice headers with payment details may reveal additional information or return repeated records. Appropriate permissions and validation of the result set help ensure that the query exposes only the intended business information.
Best Practices for Managing BAQ Permissions
A consistent access-management process makes permissions easier to review as employees change roles and reporting requirements evolve. Establish an owner for each business-critical BAQ and document its purpose, intended audience, sensitive fields, and dependencies.
- Apply least privilege: Give users only the access required to perform their assigned duties.
- Separate responsibilities: Distinguish query development and administration from routine report execution where the environment supports those controls.
- Review sensitive fields: Check whether queries expose bank details, personal information, confidential pricing, or financial records beyond their intended audience.
- Test with role-based accounts: Confirm both permitted access and expected restrictions after creating or modifying permissions.
- Review changes regularly: Reassess access after employee transfers, departures, security-group changes, and ERP upgrades.
For example, a purchasing employee who moves into accounts payable may need access to invoice and payment reporting. Updating the employee's assigned permissions and validating the new role helps preserve appropriate access without granting unrelated administrative rights.
BAQ Security in ERP Integrations and Finance Automation
BAQ security also matters when query results feed external applications, integrations, dashboards, or automated workflows. Epicor ERP supports business operations across connected functional areas, so administrators should understand how access rules apply when information moves between applications. Epicor Integration Finance involves connecting ERP data with finance workflows and supporting systems; integration design should preserve authorization, data minimization, and traceability.
When extending epicor with external finance tools, teams should confirm which identity performs each query, how credentials are managed, and whether permissions remain appropriate for the receiving system. ERP Security Best Practices for Finance Teams (2026) provides broader guidance for reviewing ERP access and integrations. For procurement workflows, a Cloud Based Purchase Order System for Secure Procurement can also be assessed for its approach to identity, approvals, and controlled access to purchasing information.
Finance automation can build on these controls. The Hyperbots Platform supports company-specific configurations for ERP integrations, workflows, roles, and general ledger structures. Process Specific Capabilities align automation with defined finance activities, while Ready to Deploy Capabilities provide pre-trained agents and ERP connectors for supported workflows. Self Learning Capabilities use human actions to refine supported decisions, and Human in the Loop supports exception escalation and approval workflows.
Where customer payment matching, remittance interpretation, unapplied cash, deductions, or receipt posting is part of the process, How Hyperbots AI Agents 10x Epicor Finance Operations describes broader finance automation around ERP workflows. These automation capabilities complement access governance; they do not replace the need to configure and test appropriate BAQ permissions.
Monitoring, Testing, and Compliance
BAQ security should be reviewed throughout the query lifecycle, from initial creation to retirement. Keep an inventory of important queries, identify the business owner, record their intended users, and test permissions after material changes. Where audit logging is available, review relevant events according to internal policies and regulatory requirements.
System Security is the broader discipline of protecting applications, identities, data, and computing resources through coordinated controls. BAQ security contributes to that discipline by governing query access and supporting appropriate use of ERP information. Documented reviews also help finance leaders demonstrate that reporting access aligns with internal control requirements.
Summary
Epicor BAQ Security governs access to Business Activity Queries and the information they return. Effective management combines user and group permissions, query ownership, application access, data authorization, and ongoing testing. By applying least privilege, reviewing sensitive fields, validating integrations, and documenting changes, organizations can protect financial information while giving employees reliable access to the reports needed for daily operations and financial decision-making.