By default, only users with a
Supervisor credential can post refunds. However, a second security step is in place to be setup to limit high refunds.
Path: Management > Setup > Property > Parameters > Section "Financial" (left side)
Search down to "2nd Code For Refunds Over$Amt" and enter the limit amount over which a second user password will be required.