Access all OUs' Expenses

This module extends the operating unit feature for expenses. It creates one new security group, "Access all OUs' expenses", placed in the Operating Units category of the user settings.

• Any user who belongs to this group is no longer limited to the operating units set on their own user record when working with expenses and expense sheets.
• The module rewrites the existing record rules that restrict expense records and expense sheets by operating unit, so that group members bypass that restriction.
• Users who are not in the group keep the previous behaviour: they only see records with no operating unit or records belonging to the operating units assigned to them.

Typical use: a shared HR team sits under one operating unit but must process expense claims coming from all operating units. Instead of adding every operating unit to each HR user, an administrator simply ticks the new group on those users.

No new menus, screens, buttons or reports are added, and no automatic computations, emails or scheduled jobs are introduced. The change is purely about who can see and act on expense data across operating units.