Whoever can read the chart of accounts can read where revenue lands; whoever
can change it can change the mapping. Without this the محاسب role sees the
Accounting menu but gets 403 on the revenue-mapping screen.

super_admin holds the '*' wildcard and needs no explicit grant.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>