Business partner process rights are controlled by maintaining authorization groups in BP master data AND assigning those groups to users. This two-step approach links object-level permissions to user access. User profiles alone don't control BP rights.