@@ -69,6 +69,14 @@ import { ADMINISTRATORS_GROUP_ID, PURCHASER_GROUP_ID } from '../permissions';
 // existing admins on first deploy of issue #923). approve-any:purchases is
 // carved out of admin:* and requires Purchaser group membership.
 const ADMIN_USER = { id: 'admin-uuid', email: 'admin@example.com', groups: [ADMINISTRATORS_GROUP_ID, PURCHASER_GROUP_ID] };
+// Admin without Purchaser membership and without effectivePermissions
+// for any carved-out spending verb. Issue #923 explicitly carves
+// approve-any:purchases / retry-any:purchases / execute:purchases OUT
+// of admin:*, so this user MUST NOT see Approve / Retry buttons on
+// rows they did not create. Regression guard for CR #924 F5 — if a
+// future refactor reintroduces isAdmin() as the gate, this test
+// catches it.
+const ADMIN_NO_PURCH = { id: 'admin-no-purch-uuid', email: 'admin-no-purch@example.com', groups: [ADMINISTRATORS_GROUP_ID] };
 // REG_USER carries the default-user effective permission set (approve-own
 // + cancel-own + retry-own on purchases) so canAccess returns true for
 // own-row actions without needing the bootstrap fetch. The previous
@@ -370,4 +378,33 @@ describe('History inline Approve button (issue #286)', () => {
     expect(cancelBtn?.disabled).toBe(false);
     expect(showToast).toHaveBeenCalledWith(expect.objectContaining({ kind: 'error' }));
   });
+
+  test('admin WITHOUT Purchaser membership does not see Approve on rows they did not create (CR #924 F5)', async () => {
+    // Issue #923 + CR #924 F5: approve-any:purchases is carved out of
+    // admin:*. canApprovePendingRow must gate on
+    // canAccess('approve-any', 'purchases'), NOT on isAdmin() or
+    // isPurchaser() group membership alone. A bare admin (no Purchaser
+    // group, no effectivePermissions yet) is exactly the case where
+    // the carve-out matters: the legacy implementation would have
+    // shown Approve on every pending row.
+    (getCurrentUser as jest.Mock).mockReturnValue(ADMIN_NO_PURCH);
+    (api.getHistory as jest.Mock).mockResolvedValue({
+      summary: {},
+      purchases: [
+        makeRow({ purchase_id: 'exec-mine', created_by_user_id: ADMIN_NO_PURCH.id }),
+        makeRow({ purchase_id: 'exec-other', created_by_user_id: OTHER_UUID }),
+        makeRow({ purchase_id: 'exec-legacy', created_by_user_id: undefined }),
+      ],
+    });
+
+    await loadHistory();
+
+    // Scope to the history list (not the approval queue card).
+    const list = document.getElementById('history-list')!;
+    const buttons = list.querySelectorAll<HTMLButtonElement>('.history-approve-btn');
+    const ids = Array.from(buttons).map((b) => b.dataset['approveId']);
+    // Approve renders only via the approve-own fallback (matching
+    // created_by_user_id), NOT approve-any.
+    expect(ids).toEqual(['exec-mine']);
+  });
 });
@@ -76,6 +76,11 @@ import { ADMINISTRATORS_GROUP_ID, PURCHASER_GROUP_ID } from '../permissions';
 // carved out of admin:* and requires Purchaser group membership.
 const ADMIN_USER = { id: 'admin-uuid', email: 'admin@example.com', groups: [ADMINISTRATORS_GROUP_ID, PURCHASER_GROUP_ID] };
 const REG_USER = { id: 'user-uuid', email: 'user@example.com', groups: [] };
+// Admin WITHOUT Purchaser membership. retry-any:purchases is carved
+// out of admin:* by issue #923, so this user MUST NOT see Retry on
+// rows they did not create. Regression guard for CR #924 F5 -- if a
+// future refactor reintroduces isAdmin() as the gate, this catches it.
+const ADMIN_NO_PURCH = { id: 'admin-no-purch-uuid', email: 'admin-no-purch@example.com', groups: [ADMINISTRATORS_GROUP_ID] };
 const OTHER_UUID = 'other-uuid';
 
 function setupDOM(): void {
@@ -433,4 +438,31 @@ describe('History inline Retry button (issue #47)', () => {
     expect(showToast).toHaveBeenCalledWith(expect.objectContaining({ kind: 'error' }));
     expect(btn?.disabled).toBe(false);
   });
+
+  test('admin WITHOUT Purchaser membership does not see Retry on rows they did not create (CR #924 F5)', async () => {
+    // Issue #923 + CR #924 F5: retry-any:purchases is carved out of
+    // admin:*. canRetryFailedRow must gate on
+    // canAccess('retry-any', 'purchases'), NOT on isAdmin() or
+    // isPurchaser() group membership alone. A bare admin (no Purchaser
+    // group, no effectivePermissions yet) is exactly the case where
+    // the carve-out matters: the legacy implementation would have
+    // shown Retry on every failed row.
+    (getCurrentUser as jest.Mock).mockReturnValue(ADMIN_NO_PURCH);
+    (api.getHistory as jest.Mock).mockResolvedValue({
+      summary: {},
+      purchases: [
+        makeRow({ purchase_id: 'fail-mine', created_by_user_id: ADMIN_NO_PURCH.id }),
+        makeRow({ purchase_id: 'fail-other', created_by_user_id: OTHER_UUID }),
+        makeRow({ purchase_id: 'fail-legacy', created_by_user_id: undefined }),
+      ],
+    });
+
+    await loadHistory();
+
+    const buttons = document.querySelectorAll<HTMLButtonElement>('.history-retry-btn');
+    const ids = Array.from(buttons).map((b) => b.dataset['retryId']);
+    // Retry renders only via the retry-own fallback (matching
+    // created_by_user_id), NOT retry-any.
+    expect(ids).toEqual(['fail-mine']);
+  });
 });
@@ -14,7 +14,7 @@
  * getRolePermissions() is kept for the effective-permissions display in
  * the admin Users page and still returns the same sets as before.
  */
-import { canAccess, getRolePermissions, isAdmin, ADMINISTRATORS_GROUP_ID, PURCHASER_GROUP_ID } from '../permissions';
+import { canAccess, getRolePermissions, isAdmin, isPurchaser, ADMINISTRATORS_GROUP_ID, PURCHASER_GROUP_ID } from '../permissions';
 import type { PermissionEntry } from '../api/types';
 
 jest.mock('../state', () => ({
@@ -343,5 +343,117 @@ describe('permissions', () => {
       expect(canAccess('view', 'recommendations')).toBe(false);
       expect(canAccess('admin', '*')).toBe(false);
     });
+
+    test('custom (non-seeded) group with carved-out grants in effectivePermissions allows spending', () => {
+      // CR #924 F4 + F5 regression: a custom group that does not include
+      // PURCHASER_GROUP_ID but DOES carry execute/approve-any/retry-any
+      // on purchases must satisfy canAccess for those verbs. The seeded
+      // Purchaser group is not the only legitimate source of the
+      // carve-out; the backend already allows this shape via the
+      // group's effectivePermissions, so the frontend must agree.
+      const customGid = '00000000-0000-5000-8000-00000000abcd';
+      const perms: PermissionEntry[] = [
+        { action: 'execute', resource: 'purchases' },
+        { action: 'approve-any', resource: 'purchases' },
+        { action: 'retry-any', resource: 'purchases' },
+        { action: 'view', resource: 'recommendations' },
+        { action: 'view', resource: 'plans' },
+        { action: 'view', resource: 'purchases' },
+        { action: 'view', resource: 'history' },
+      ];
+      mockUserWithGroups([customGid], perms);
+      // The three carved-out spending verbs are granted by the explicit
+      // entries even without PURCHASER_GROUP_ID membership.
+      expect(canAccess('execute', 'purchases')).toBe(true);
+      expect(canAccess('approve-any', 'purchases')).toBe(true);
+      expect(canAccess('retry-any', 'purchases')).toBe(true);
+      expect(canAccess('view', 'recommendations')).toBe(true);
+      expect(canAccess('view', 'history')).toBe(true);
+      // Non-purchaser admin actions remain denied.
+      expect(canAccess('admin', '*')).toBe(false);
+      expect(canAccess('delete', 'plans')).toBe(false);
+      expect(canAccess('view', 'users')).toBe(false);
+      expect(canAccess('cancel-any', 'purchases')).toBe(false);
+    });
+  });
+
+  describe('isPurchaser', () => {
+    test('seeded Purchaser group member (no effectivePermissions yet) returns true via fallback', () => {
+      // Pre-bootstrap loading window: effectivePermissions not yet
+      // populated. The helper falls back to seeded group membership.
+      mockUserWithGroups([PURCHASER_GROUP_ID]);
+      expect(isPurchaser()).toBe(true);
+    });
+
+    test('user without Purchaser group and no effectivePermissions returns false', () => {
+      mockUserWithGroups([ADMIN_GID]); // admin only
+      expect(isPurchaser()).toBe(false);
+    });
+
+    test('explicit execute:purchases grant in effectivePermissions (custom group) returns true', () => {
+      // CR #924 F4: isPurchaser() must reflect effective permissions,
+      // not just seeded group ID. A user whose custom group grants
+      // execute:purchases is a spender even without PURCHASER_GROUP_ID.
+      const customGid = '00000000-0000-5000-8000-00000000beef';
+      mockUserWithGroups([customGid], [
+        { action: 'execute', resource: 'purchases' },
+        { action: 'view', resource: 'recommendations' },
+      ]);
+      expect(isPurchaser()).toBe(true);
+    });
+
+    test('explicit approve-any:purchases grant returns true', () => {
+      const customGid = '00000000-0000-5000-8000-00000000cafe';
+      mockUserWithGroups([customGid], [
+        { action: 'approve-any', resource: 'purchases' },
+      ]);
+      expect(isPurchaser()).toBe(true);
+    });
+
+    test('explicit retry-any:purchases grant returns true', () => {
+      const customGid = '00000000-0000-5000-8000-00000000face';
+      mockUserWithGroups([customGid], [
+        { action: 'retry-any', resource: 'purchases' },
+      ]);
+      expect(isPurchaser()).toBe(true);
+    });
+
+    test('wildcard resource on a carved-out action grants Purchaser (matches canAccess semantics)', () => {
+      // canAccess('execute', 'purchases') returns true for a
+      // {execute, *} entry. isPurchaser() must agree so the two helpers
+      // do not diverge when an unusual-but-legal permission shape
+      // arrives from the backend.
+      const customGid = '00000000-0000-5000-8000-00000000d00d';
+      mockUserWithGroups([customGid], [
+        { action: 'execute', resource: '*' },
+      ]);
+      expect(isPurchaser()).toBe(true);
+    });
+
+    test('admin:* in effectivePermissions WITHOUT explicit carved-out grants returns false', () => {
+      // The backend carves the three spending verbs OUT of admin:*.
+      // isPurchaser() must reflect that carve-out: a user whose
+      // effectivePermissions are admin:* only (no explicit carve-out
+      // entries from Purchaser membership) is NOT a spender. Note that
+      // {admin, *} does NOT match {execute, *} / {approve-any, *} /
+      // {retry-any, *} because the actions differ.
+      mockUserWithGroups([ADMIN_GID], [
+        { action: 'admin', resource: '*' },
+      ]);
+      expect(isPurchaser()).toBe(false);
+    });
+
+    test('empty effectivePermissions array returns false even with PURCHASER_GROUP_ID', () => {
+      // Loading is complete (effectivePermissions is defined and
+      // empty); group membership without backend confirmation is not
+      // enough.
+      mockUserWithGroups([PURCHASER_GROUP_ID], []);
+      expect(isPurchaser()).toBe(false);
+    });
+
+    test('null user (logged out) returns false', () => {
+      mockNoUser();
+      expect(isPurchaser()).toBe(false);
+    });
   });
 });
@@ -94,6 +94,15 @@ const mockUser = (role: string | null) => {
   );
 };
 
+// Direct group-set mocking for tests that need to assert specific
+// group combinations (e.g. admin WITHOUT Purchaser for the carve-out
+// regression checks per CR #924 F5).
+const mockUserWithGroups = (groups: string[], effectivePermissions?: { action: string; resource: string }[]) => {
+  (state.getCurrentUser as jest.Mock).mockReturnValue(
+    { id: 'u', email: 'u@example.com', groups, effectivePermissions },
+  );
+};
+
 const setupDom = () => {
   const recsTab = document.createElement('div');
   recsTab.id = 'opportunities-tab';
@@ -176,6 +185,49 @@ describe('Recommendations action-box permission gating (issue #365)', () => {
     expect(plan.hidden).toBe(true);
   });
 
+  test('admin WITHOUT Purchaser hides Purchase, keeps Create Plan, shows no-Purchaser notice (CR #924 F3)', async () => {
+    // Issue #923 + CR #924 F3: execute:purchases is carved out of
+    // admin:*. A bare admin (no Purchaser group, no effectivePermissions
+    // yet) sees the Create Plan button (create:plans is NOT carved out)
+    // but NOT the Purchase one-off button. The no-Purchaser banner must
+    // appear, driven by canAccess('execute', 'purchases') so it stays
+    // in lockstep with the Purchase CTA.
+    mockUserWithGroups([ADMINISTRATORS_GROUP_ID]);
+    await loadRecommendations();
+    const purchase = document.getElementById('bulk-purchase-btn') as HTMLButtonElement;
+    const plan = document.getElementById('create-plan-btn') as HTMLButtonElement;
+    expect(purchase).not.toBeNull();
+    expect(plan).not.toBeNull();
+    expect(purchase.hidden).toBe(true);
+    expect(plan.hidden).toBe(false);
+    // No-Purchaser banner present.
+    const actionBox = document.getElementById('recommendations-action-box')!;
+    const banners = actionBox.querySelectorAll('.info-banner');
+    expect(banners.length).toBe(1);
+    expect(banners[0]?.textContent).toContain('You can view but not execute purchases');
+  });
+
+  test('custom (non-seeded) group with explicit execute:purchases shows Purchase + no banner (CR #924 F3/F4)', async () => {
+    // CR #924 F3 + F4: the banner must NOT appear when a custom group
+    // (not PURCHASER_GROUP_ID) carries execute:purchases via
+    // effectivePermissions. The previous isPurchaser()-only predicate
+    // would have shown the contradictory "you can view but not execute"
+    // notice alongside a live Purchase CTA.
+    const customGid = '00000000-0000-5000-8000-00000000abcd';
+    mockUserWithGroups([customGid], [
+      { action: 'execute', resource: 'purchases' },
+      { action: 'create', resource: 'plans' },
+      { action: 'view', resource: 'recommendations' },
+    ]);
+    await loadRecommendations();
+    const purchase = document.getElementById('bulk-purchase-btn') as HTMLButtonElement;
+    expect(purchase.hidden).toBe(false);
+    // No banner -- the predicate matches the live CTA.
+    const actionBox = document.getElementById('recommendations-action-box')!;
+    const banners = actionBox.querySelectorAll('.info-banner');
+    expect(banners.length).toBe(0);
+  });
+
   test('the action-box capacity input stays visible for all sessions', async () => {
     // Non-mutating elements stay visible regardless of group membership;
     // only the action CTAs gate on permissions.
 
@@ -11,7 +11,7 @@ import { confirmDialog } from './confirmDialog';
 import { buildApprovalDetailsBody } from './approval-details';
 import { showToast } from './toast';
 import { getCurrentUser } from './state';
-import { isAdmin, canAccess, isPurchaser } from './permissions';
+import { canAccess } from './permissions';
 import { showSkeletonRows, teardownSkeleton } from './lib/skeleton';
 import { getAccountName } from './recommendations';
 
@@ -408,18 +408,24 @@ function canCancelPendingRow(p: HistoryPurchase): boolean {
 //
 // Heuristic:
 //   * status must be "pending" or "notified";
-//   * Purchaser-group member → approve-any (issue #923: approve-any is
-//     carved out of admin:* and requires explicit Purchaser membership);
-//   * non-Purchaser matching the row's created_by_user_id → approve-own;
-//   * legacy rows with NULL created_by_user_id → no (the email-token path
-//     remains the escape hatch).
+//   * any session with approve-any:purchases (carved-out admin verb,
+//     seeded on Purchaser group; can also come from a custom group via
+//     effectivePermissions) → approve-any;
+//   * otherwise the row's created_by_user_id must match the current
+//     user (approve-own);
+//   * legacy rows with NULL created_by_user_id → no (the email-token
+//     path remains the escape hatch).
 function canApprovePendingRow(p: HistoryPurchase): boolean {
   const status = (p.status || '').toLowerCase();
   if (status !== 'pending' && status !== 'notified') return false;
   const user = getCurrentUser();
   if (!user) return false;
-  // Purchaser group membership grants approve-any (issue #923).
-  if (isPurchaser()) return true;
+  // approve-any:purchases is carved out of admin:* (issue #923) and is
+  // granted by the seeded Purchaser group OR any custom group that
+  // explicitly lists the verb in effectivePermissions. Gate on the
+  // verb directly so a non-seeded role with the same grant still
+  // approves rows the backend would also let through.
+  if (canAccess('approve-any', 'purchases')) return true;
   if (!p.created_by_user_id) return false;
   return p.created_by_user_id === user.id;
 }
@@ -436,18 +442,24 @@ function canApprovePendingRow(p: HistoryPurchase): boolean {
 //   * row must NOT already have a retry_execution_id (we don't allow
 //     retrying the same failure twice — the user should retry the
 //     latest descendant in the chain);
-//   * Purchaser-group member → retry-any (issue #923: retry-any is
-//     carved out of admin:* and requires explicit Purchaser membership);
-//   * non-Purchaser matching the row's created_by_user_id → retry-own.
+//   * any session with retry-any:purchases (carved-out admin verb,
+//     seeded on Purchaser group; can also come from a custom group via
+//     effectivePermissions) → retry-any;
+//   * otherwise the row's created_by_user_id must match the current
+//     user (retry-own).
 function canRetryFailedRow(p: HistoryPurchase): boolean {
   const status = (p.status || '').toLowerCase();
   if (status !== 'failed') return false;
   if (p.ops_hint) return false;
   if (p.retry_execution_id) return false; // already retried — user should act on the descendant
   const user = getCurrentUser();
   if (!user) return false;
-  // Purchaser group membership grants retry-any (issue #923).
-  if (isPurchaser()) return true;
+  // retry-any:purchases is carved out of admin:* (issue #923) and is
+  // granted by the seeded Purchaser group OR any custom group that
+  // explicitly lists the verb in effectivePermissions. Gate on the
+  // verb directly so a non-seeded role with the same grant still
+  // retries rows the backend would also let through.
+  if (canAccess('retry-any', 'purchases')) return true;
   if (!p.created_by_user_id) return false;
   return p.created_by_user_id === user.id;
 }
@@ -579,12 +591,19 @@ function renderHistoryList(purchases: HistoryPurchase[]): void {
 
   lastPurchases = purchases;
 
-  // Issue #923: inject a read-only notice for sessions that lack Purchaser
-  // group membership. The Approve / Retry buttons in the table are gated by
-  // canApprovePendingRow / canRetryFailedRow (which use isPurchaser), so this
-  // banner explains why those buttons are absent for admin-only sessions.
+  // Issue #923: inject a read-only notice for sessions that lack the
+  // carved-out spending verbs the buttons in this table need. Approve /
+  // Retry are gated by canApprovePendingRow / canRetryFailedRow which
+  // call canAccess('approve-any','purchases') and
+  // canAccess('retry-any','purchases'); use the same predicate here so
+  // the banner stays in lockstep with the visible buttons (a user who
+  // holds either verb via a custom group sees no contradictory
+  // notice).
+  const canApproveAny = canAccess('approve-any', 'purchases');
+  const canRetryAny = canAccess('retry-any', 'purchases');
+  const hasAnyCarvedOut = canApproveAny || canRetryAny;
   const existingBanner = document.getElementById('history-no-purchaser-banner');
-  if (!existingBanner && !isPurchaser()) {
+  if (!existingBanner && !hasAnyCarvedOut) {
     const banner = document.createElement('div');
     banner.id = 'history-no-purchaser-banner';
     banner.className = 'info-banner';
@@ -593,7 +612,7 @@ function renderHistoryList(purchases: HistoryPurchase[]): void {
       'You can view but not execute purchases. ' +
       'Ask an admin to add you to the Purchaser group, or add yourself in Settings → Users.';
     container.parentElement?.insertBefore(banner, container);
-  } else if (existingBanner && isPurchaser()) {
+  } else if (existingBanner && hasAnyCarvedOut) {
     existingBanner.remove();
   }