fix: 用专用权限收窄经理 AP 访问（09-07-manager-ap-access-scope）

.trellis/spec/hyb-oa/security-privacy.md

@@ -18,6 +18,56 @@
   redacted form.
 - `scripts/qa/check-trellis-governance.mjs` must pass before commit.
 
+## Scenario: AP Full-Ledger Reading Is Not Payment Review
+
+### 1. Scope / Trigger
+
+AP financial summary and reimbursement ledger reads, not general entity visibility.
+
+### 2. Signatures
+
+- Permission: `finance.ledger.view` in both server and client role maps.
+- Reads: `GET /api/ap-operations` and `GET /api/ap-operations/reimbursement-ledger`.
+- Separate export: `POST /api/exports/ap-operations`.
+
+### 3. Contracts
+
+Grant ledger reading to `ceo`, `finance`, `finance_mgr`, not `manager` or
+`system_admin`. Preserve emergency `admin` wildcard semantics. Both reads require
+the dedicated permission before data queries; query filters cannot confer access.
+Frontend route and navigation projections use the same permission. Keep manager
+payment review and multi-role permission unions intact; never grant CEO payment
+management to preserve read access. Export keeps its existing independent
+`payment.batch.manage` / `risk.review.manage` rule.
+
+### 4. Validation & Error Matrix
+
+Feature enabled: missing ledger permission returns 403 / `PERM_001`, with no
+financial query. Feature disabled: the existing 409 refusal may occur first.
+CEO/finance/finance manager and manager+finance retain reading. Old payment or
+risk permissions alone no longer imply ledger reading.
+
+### 5. Good / Base / Bad Cases
+
+- Base: manager keeps payment review but cannot enter AP.
+- Good: CEO reads AP without acquiring export or payment-write rights.
+- Bad: hiding a menu while leaving either backend read unrestricted.
+
+### 6. Tests Required
+
+Route injection checks both reads, filters and zero queries on refusal; role and
+navigation tests cover CEO and mixed roles. Browser checks cover manager direct
+refusal and preserved payment entry, plus allowed AP readers. Export and payment
+review regressions remain separate from ledger authorization.
+
+### 7. Wrong vs Correct
+
+Wrong: `payment.batch.review` implies all-company financial visibility, or a CEO
+role exception is added to AP handlers. Correct: use `finance.ledger.view` in role
+maps and read guards. This AP-only change does not alter the manager's six
+`*.view_all` permissions: reimbursement-list all-record visibility remains an
+explicit deferred decision, not a completed scope restriction.
+
 ## Scenario: Bank Account Snapshots And Payment-Order Export
 
 ### 1. Scope / Trigger