This fix ensures sensitive payroll details, such as salary and contract information, are only visible to authorized payroll or HR manager users. It also improves payroll-related employee record handling so routine HR updates avoid access errors and unnecessary processing.

Forward-Port-Of: odoo/enterprise#89553

This update tightens who can access IAP account tokens used by several document extraction, tax, and signing services. It helps protect sensitive service credentials while keeping the affected business workflows working as expected.