@Ogabeg their role should have at least view permission for "make journal entries"