Have you already noticed the new way of assigning access rights to operators and operator groups? Check out the KB article Permissions for the whole story.
In addition to the existing ones, there is now also the Financial operator permission. This is meant for operators who need to have access to invoices, and be able to place orders or make payments. By default, the financial operator permission will be added to the Administrators operator group, but this can be changed if necessary.