If so, how do you ensure that a payroll user doesn't start an AP workflow, or vice versa? I am looking for a way to restrict this to authorized users, but I'm not having much luck. Curious what others are doing.