our client wants to seperate the authorization about payroll,so some person can only see the log and maintain the data,but have no right to run payroll and do bank transfer,is it possible?