It should be implemented a way to filter out which invoice types are visible to users based on the role. Now the user that has access to Operations->Costing->Invoices can see all the types of invoices. This can be a problem in particular with the user invoice that are visible to all the user. In our case we use the SAM SSO identity source and username is the personal ID. This is a private data and shouldnot be visible to other users . It should be usefull to filter the type of invoces a user can see.
I think you could possibly achieve this filter using a plugin. Using JavaScript in a Global UI Provider, the script would hide rows of type User, and remove the User option from the filter drop down. It could probably do that conditionally for any user except a super admin, by inspecting the DOM.
Caveat: The elements would be removed in the browser DOM, so it’s not the role filter you are requesting but thought to mention it, as it could suffice.