# BCOS Build Sprint 13 — Finance Foundation

Delivered project budgets, client funding receipts, expenses and approvals, invoices and lines, payments and generated receipt records, refunds, internal exchange-rate records, live project/client finance views, permission-scoped APIs, audit events, and responsive React finance screens.

## Security controls
- Finance permissions are separate by function.
- Users cannot approve their own expenses.
- Payment confirmation and receipt creation are transactional.
- Historical rates are stored internally and never fetched from an external API.
- Financial dashboards use server-side views rather than client calculations as the source of truth.