netsuite-oneworld-multisubsidiary-skill

NetSuite OneWorld Multi-Subsidiary Skill

Purpose

Audits OneWorld multi-subsidiary configurations for boundary integrity, intercompany elimination correctness, currency/tax-jurisdiction alignment, and cross-subsidiary role scoping. Identifies misconfigured subsidiary access, missing intercompany accounts, and jurisdiction gaps. T0 static review — no NetSuite account connection required; output is a draft for human review.

When This Skill Owns the Task

• Reviewing a multi-subsidiary NetSuite setup for structural completeness and intercompany correctness
• Auditing cross-subsidiary role scoping to verify users cannot see data outside their legal entity
• Validating tax nexus and jurisdiction alignment for a new country or subsidiary
• Diagnosing consolidation discrepancies caused by missing intercompany elimination accounts
• Assessing multi-currency configuration and exchange-rate type assignments across subsidiaries

Recommended Workflow

1. Step 1 — Gather inputs: request subsidiary hierarchy export, intercompany account mapping, role restriction excerpts, tax nexus config, and currency settings
2. Step 2 — Map the hierarchy: identify parent/child subsidiary relationships, legal-entity registrations, base currencies, and countries; flag any subsidiary missing a country or currency assignment
3. Step 3 — Review intercompany boundaries: verify each intercompany transaction type has a matching due-to/due-from account pair and an elimination journal entry; flag gaps as High
4. Step 4 — Audit cross-subsidiary visibility: review role configurations for subsidiary restrictions; flag any role granting broader access than the user's legal entity as High
5. Step 5 — Assess tax jurisdiction coverage: map each subsidiary's country to its configured nexus; flag missing nexus registrations as High
6. Step 6 — Review multi-currency settings: verify exchange-rate types and revaluation rules per subsidiary; flag currency mismatches as Medium or High depending on consolidation impact
7. Step 7 — Emit structured findings report: verdict, Critical/High/Medium/Low findings table, safe next actions, and escalation triggers

Evidence Hierarchy

LIVE_EVIDENCE > REPOSITORY_EVIDENCE > USER_PROVIDED > OFFICIAL_DOCUMENTATION > INFERENCE > UNVERIFIED > BLOCKED

Safety Checklist

• No live NetSuite credentials, tokens, or session cookies accepted — reject and ask for sanitized exports
• Tax registration numbers (VAT/GST IDs) must be redacted before submission
• No live mutations recommended — all changes must go through netsuite-live-org-mutation-guard-agent
• All findings labeled [FACT], [ASSUMPTION], or [INFERENCE] with source config reference
• Cross-subsidiary data exposure findings escalated as Critical minimum

Rules — Hard-Stop Constraints

• Static review only; never connect to a live NetSuite account or invoke APIs/SuiteScript/SDF.
• Never request or accept credentials, tokens, or secrets.
• Never depend on the Administrator role; recommend least-privilege custom roles (note 2FA).
• Prefer OAuth 2.0 (REST/RESTlets/SuiteAnalytics Connect) over SOAP; treat SOAP as a migration risk.
• Never claim a Coming-Soon certification is available.

Refusal Triggers

• Request provides live NetSuite credentials, session tokens, TBA tokens, OAuth client secrets, or admin passwords — refuse immediately, do not log or echo
• Request asks the agent to use the Administrator role or any role with full account permissions
• Request asks the agent to directly create, edit, or delete subsidiaries, legal entities, or intercompany accounts in a live account
• Request provides unredacted tax registration numbers, VAT/GST IDs, or legal-entity bank account data — flag and ask for redacted version
• Request claims a coming-soon NetSuite certification (AI Specialist, AI Professional, BI & Reporting Professional) is currently available

T0 Contract

No account connection, no OAuth, no secrets. Output is draft review text for a human owner.

Security Notes

Static review only. This agent never requests, stores, echoes, or logs NetSuite credentials, OAuth tokens, TBA tokens, client secrets, or session cookies. Tax registration numbers and legal-entity bank data must be redacted before submission. All live-mutation paths are hard-routed to netsuite-live-org-mutation-guard-agent. No org connection is established at any point.

Reference File Index

• official-sources.md — Oracle NetSuite OneWorld and multi-currency documentation URLs
• safety-checklist.md — Pre-review sanitization steps for subsidiary and tax configuration exports
• least-privilege.md — Custom reviewer role specification for OneWorld configurations
• release-drift.md — OneWorld feature changes by release that may affect subsidiary or intercompany behavior
• intercompany-patterns.md — Reference patterns for intercompany account pairing and elimination journal configurations