NetSuite SuiteApprovals 2026.2.1 introduces a new script execution role and changes the permissions required to submit, approve, reject, and resubmit supported records.
The update was targeted for September 29, 2026 in sandbox and Release Preview accounts, with the production release targeted for October 20, 2026. Administrators using SuiteApprovals should review affected script deployments and user roles before the production upgrade.
Accounts using vendor bill approvals, Employee Center roles, Engineering Change Order (ECO) approvals, or customized approver roles require particular attention.
This SuiteApprovals update is separate from NetSuite’s broader SuiteScript 2.1 transition. While SuiteApprovals 2026.2.1 focuses on script execution roles and approval permissions, organizations with custom SuiteScripts should also be reviewing older scripts ahead of upcoming runtime changes. Our SuiteScript 2.1 migration guide covers that process separately.
What Is Changing in NetSuite SuiteApprovals 2026.2.1?
SuiteApprovals 2026.2.1 introduces the new SAS – Script Executor role and changes several permission requirements for SuiteApprovals users. Existing roles may need to be updated before users can continue submitting, approving, rejecting, or resubmitting affected records.
The main changes are:
| Area | SuiteApprovals 2026.2.1 change |
| Script execution | New SAS – Script Executor role |
| Transaction approval/rejection | At least Edit permission for the applicable transaction type |
| Submit/Resubmit | At least Create permission for the applicable transaction type |
| Vendor bill approval | Employee Center roles cannot provide the required Bills access |
| ECO and Email Approval Log | At least View access for Custom Record Types |
| ECO script execution | A customized script execution role with the required ECO permissions is needed |
The update affects two areas of SuiteApprovals configuration: the roles used by SuiteApprovals scripts and the permissions assigned to users participating in approval processes.
Oracle’s SuiteApprovals documentation provides additional information about approval rules, approver roles, supported records, script deployments, and subsidiary access.
Oracle: Setting Up SuiteApprovals
What Is the SAS – Script Executor Role in NetSuite?
SAS – Script Executor is a new locked role managed by the SuiteApprovals SuiteApp. It is intended specifically for SuiteApprovals script execution and should not be assigned to employee records.
The role provides SuiteApprovals scripts with the permissions and access required to perform their functions.
After the 2026.2.1 upgrade, the Execute as Role field will be set to SAS – Script Executor for these deployments:
- SAS Approval List SU
- SAS Approval Rule SU
- SAS Approval Rule List SU
- SAS Approval Rule Assistant
- SAS Supported Records SU
For these deployments, SAS – Script Executor will also be selected in the Internal Roles field on the Audiences subtab.
The SAS Email Approval Processing SU deployment is handled differently. Its Execute as Role field will change to SAS – Script Executor, while its Internal Roles field will remain unchanged.
Administrators should verify these deployment settings after their SuiteApprovals SuiteApp has been upgraded.
What Permissions Do SuiteApprovals Approvers Need?
SuiteApprovals 2026.2.1 requires transaction approvers to have at least Edit permission for every transaction type they approve or reject. Previously, eligible approvers could perform these actions with View permission.
This means an approver’s eligibility alone is no longer enough. The role they use also needs the required permission level for the relevant transaction.
For example, an employee responsible for approving Purchase Orders should have at least Edit access for the applicable transaction permission.
Administrators should identify the transaction types handled by each approver and compare them against the permissions available through their assigned roles.
Role restrictions also matter. In OneWorld accounts, an approver may have the appropriate transaction permission but still lack access to a record because of subsidiary restrictions.
Oracle: SuiteApprovals Role-Based Approvers
What Permissions Are Required to Submit or Resubmit Records in SuiteApprovals?
Submit for Approval and Resubmit actions will require at least Create permission for the applicable supported transaction type under SuiteApprovals 2026.2.1. Previously, these actions required at least Edit permission.
The role review therefore needs to cover employees who submit transactions, not only approvers.
When testing the change, follow the complete approval path:
Record Created
↓
Submit for Approval
↓
Approval Rule
↓
Approve / Reject
↓
Resubmit if required
Each user should perform their part of the process using the role they will use in production.
What Permissions Are Required to Approve Vendor Bills in SuiteApprovals?
Vendor bill approvers will need a role with at least Edit access for the Bills permission. Standard and customized Employee Center roles cannot provide the required access, so affected approvers will need to use another role.
This is one of the more significant changes for organizations using Employee Center for vendor bill approvals.
Oracle’s existing documentation describes using a customized Employee Center role with View permission for Bills when configuring vendor bill approvals.
Oracle: Customizing Employee Center Roles for SuiteApprovals
Under the 2026.2.1 requirements communicated by NetSuite, that permission level will no longer be sufficient for approving or rejecting vendor bills.
Affected users need a standard or custom role that is not an Employee Center role and provides:
- at least Edit access for Bills;
- the required SuiteApprovals permissions;
- appropriate record access;
- appropriate subsidiary access.
The approver must then use that role when approving or rejecting vendor bills.
Administrators should test this using the replacement role rather than assuming that changing the Bills permission alone covers the complete approval process.
How Do You Update SuiteApprovals for Engineering Change Order Approvals?
If SuiteApprovals is used for Engineering Change Orders, create a customized copy of SAS – Script Executor, add the required ECO permissions, and configure the affected script deployments to use the customized role. Test the ECO approval workflow before processing ECO records in production.
The additional configuration is required because the standard SAS – Script Executor role does not include the permissions needed to process ECO records.
NetSuite’s upgrade instructions require administrators to:
- Create a customized copy of SAS – Script Executor.
- Add the required ECO permissions.
- Update the affected script deployments to use the customized role.
- Test the ECO approval workflow.
After the production account receives the upgrade, the applicable configuration needs to be repeated before processing ECO records.
Oracle’s Engineering Change Order documentation provides additional information about ECO roles and permissions.
Oracle: Customizing Roles for Engineering Change Orders
This step should not be skipped simply because other SuiteApprovals transactions are working correctly. ECO processing has its own permission requirements.
Which NetSuite Roles Need to Be Updated for SuiteApprovals 2026.2.1?
Review roles used by transaction approvers, transaction submitters, vendor bill approvers, ECO approvers, and Email Approval Log approvers. A role only needs changes where its current permissions do not meet the new requirements.
A practical role review can be organized like this:
| User/role | What to review |
| Transaction approvers | Edit permission for each transaction type they approve/reject |
| Transaction submitters | Create permission for applicable supported transaction types |
| Vendor bill approvers | Use of Employee Center and Edit access for Bills |
| ECO approvers | Required ECO and Custom Record Types permissions |
| Email Approval Log approvers | View access for Custom Record Types |
| OneWorld approvers | Relevant subsidiary and record access |
This review should be based on what each role does in the approval process. Giving every approver broader permissions than necessary is not the purpose of the change.
For accounts with customized roles, approval rules, subsidiaries, or SuiteApps, these permission changes should be reviewed alongside the existing NetSuite configuration. Folio3’s NetSuite consulting team can help assess how changes to roles, workflows, and customizations affect the processes already running in the account.
How Do You Check Which SuiteApprovals Users Are Affected?
Start by identifying the users who submit or approve records through SuiteApprovals, then map each user to the role and transaction types they use. Compare those permissions against the new requirements before changing the role configuration.
A simple assessment can capture:
| User | Role | Approval responsibility | Current permission | Required permission | Change needed |
| Approver A | Custom AP Role | Vendor Bills | View | Edit | Yes |
| Approver B | Purchasing Role | Purchase Orders | Edit | Edit | No |
| User C | Custom Transaction Role | Submit transaction | Create | Create | No |
This is especially useful in accounts with several custom roles because the same approval rule may contain users with different permission configurations.
Also check whether users switch roles for different responsibilities. This is particularly relevant to vendor bill approvers who will no longer be able to rely on an Employee Center role for the affected approval actions.
How To Test SuiteApprovals 2026.2.1 Before Production?
Test the upgraded SuiteApprovals configuration in sandbox or Release Preview using the same roles employees will use in production. Verify submission, approval, rejection, resubmission, record access, and any applicable vendor bill or ECO processes.
Testing with Administrator access alone will not expose many of the permission issues this update can create.
A practical test matrix includes:
| Scenario | What to test |
| Submit for Approval | User can submit the intended record |
| Approve | Approver can access and approve it |
| Reject | Approver can reject it |
| Resubmit | User can resubmit where applicable |
| Vendor Bill | Replacement role can approve and reject bills |
| ECO | Customized script role and ECO workflow work correctly |
| Email Approval | Existing email approval process still works |
| Subsidiary access | Approvers can access the required records |
| Custom roles | Required permissions are available to intended users |
Run these tests against the approval processes your organization actually uses. Successful Purchase Order approval, for example, does not prove that Vendor Bill approval is configured correctly because the permissions and roles involved can be different.
Release changes can also expose existing problems with roles, workflows, or account configuration. Organizations that need ongoing assistance reviewing NetSuite updates, troubleshooting approval processes, or testing changes can use Folio3’s NetSuite Support Services.
What Happens If You Don’t Update SuiteApprovals Permissions?
Approvers whose roles do not meet the new requirements may be unable to approve or reject affected transactions. ECO approval workflows may also fail to operate correctly if the required script deployment configuration is not completed.
The result can be transactions remaining in an approval process until an administrator identifies and corrects the role or deployment issue.
This can affect purchasing, accounts payable, or change-management processes where approval is required before the transaction can move forward.
Testing before production gives administrators an opportunity to identify these issues before they affect live transactions.
What Should You Do Before the SuiteApprovals 2026.2.1 Production Update?
Review affected roles and script deployments, make the applicable changes in an upgraded sandbox or Release Preview account, and test the approval processes before applying the configuration in production. Pay particular attention to Employee Center vendor bill approvers and accounts using ECO approvals.
Use this checklist:
- Confirm SuiteApprovals 2026.2.1 is available in sandbox or Release Preview.
- Review affected SuiteApprovals script deployments.
- Verify SAS – Script Executor after the upgrade.
- Identify approvers with only View access to transactions they approve.
- Review permissions for users who submit or resubmit transactions.
- Identify vendor bill approvers using Employee Center roles.
- Prepare an appropriate replacement role for affected vendor bill approvers.
- Review ECO and Email Approval Log permissions.
- Configure a customized SAS – Script Executor role if ECO approvals are used.
- Test submission, approval, rejection, and resubmission.
- Test vendor bill and ECO processes where applicable.
- Verify record and subsidiary access.
- Document changes that need to be applied after the production upgrade.
For complex SuiteApprovals environments, document which role was changed, why it was changed, which approval process depends on it, and how the updated configuration was tested. This gives administrators a useful reference when the same changes need to be applied or verified in production.
How Do You Manage SuiteApprovals Roles and Permissions After the Update?
Keep SuiteApprovals roles, script deployments, approval rules, and supported records documented together. Future changes to a role or transaction permission can affect whether an existing approval process continues to work as expected.
This becomes particularly useful for accounts with multiple approval rules, custom approver roles, multiple subsidiaries, Employee Center users, ECO approval processes, or email approvals.
Oracle’s SuiteApprovals documentation should remain the primary product reference for supported functionality and configuration.
Oracle NetSuite SuiteApprovals Documentation
Need Help Reviewing Your SuiteApprovals Configuration?
If you’re preparing for SuiteApprovals 2026.2.1 and need help reviewing approver roles, script deployments, permissions, or testing affected approval processes, Folio3 can help assess the existing configuration and identify what needs attention before the changes reach production.
Frequently Asked Questions
When is SuiteApprovals 2026.2.1 being released?
NetSuite’s upgrade notice targeted September 29, 2026 for sandbox and Release Preview accounts and October 20, 2026 for production accounts.
What is SAS – Script Executor in NetSuite?
SAS – Script Executor is a locked role managed by the SuiteApprovals SuiteApp for SuiteApprovals script execution. It is not intended to be assigned to employee records.
Do SuiteApprovals approvers need Edit permission?
Yes. For affected transaction approvals under SuiteApprovals 2026.2.1, transaction approvers need at least Edit permission for each transaction type they approve or reject.
What permission is required to submit a transaction for approval?
Submit for Approval and Resubmit require at least Create permission for the applicable supported transaction type under the 2026.2.1 requirements.
Can Employee Center users approve vendor bills in SuiteApprovals 2026.2.1?
Vendor bill approvers need at least Edit access for Bills. Standard and customized Employee Center roles cannot provide the required access, so affected approvers need an alternative standard or custom role.
Do ECO approvals need to be updated?
Yes. Accounts using SuiteApprovals for Engineering Change Orders need to customize SAS – Script Executor with the required ECO permissions and update the affected script deployments before processing ECO records.
Should SuiteApprovals 2026.2.1 be tested in sandbox?
Yes. Applicable role and deployment changes should be tested in an upgraded sandbox or Release Preview account before they are applied to production.
