Access permissions should start with roles, not people

Copying someone's access creates quiet risk

When a new employee joins, a manager may ask IT to 'make them like that colleague'. It saves minutes but can grant unnecessary access to files, groups and sensitive information. Exceptions then accumulate as people move between roles.

Protection starts with understanding each role's real business duties, not with buying another security tool.

The root cause is missing role definition

Without a clear list of roles, resources and data owners, access is copied from people rather than justified by work. It can survive role changes or departures.

Separate personal identity from role permissions, and give temporary exceptions an expiry and review.

Grant the minimum access needed for work

Document a role's essential tasks, documents, groups, sending rights and approvals. Ask the data owner who may read, edit or authorize changes. Test that access is sufficient but no broader than needed.

Photo source: Pexels.

• A defined role and accountable approver.
• Resources mapped to an actual work need.
• An expiry or review point for exceptional access.

Related perspective: Backups Are Not Enough: Test Business Recovery

Operate a complete account lifecycle

Use a standard joiner request, approvals from the role manager and relevant data owner, multi-factor authentication, and a user access check. For movers and leavers, remove old permissions and disable accounts using a documented checklist.

Review sensitive roles periodically and keep an audit trail of requests and approvals.

Hypothetical example: new sales employee

Imagine a new salesperson needs customer and proposal records but receives payroll edit rights because their account was cloned from a former manager. Role-based groups and owner-reviewed membership would prevent that drift.

This is a hypothetical scenario, not a reported client security incident.

Measure the access model

Track accounts without owners, open exceptions, time to remove access after departure, and multi-factor authentication coverage. Test that users cannot access information outside their duties.

• Every account maps to an identified role.
• Permission changes can be traced.
• Recurring reviews remove obsolete access.

A work-based access matrix

Pilot three roles first: Sales, Finance, and System Administration. For each, document what people can read, edit, and approve; then test the permissions with a non-production account.

Give exceptional access a reason, expiry, and review owner. Temporary access without a review date becomes permanent in practice.

Make identity governance part of operating design

Setting up Microsoft 365 or Google Workspace means more than creating mailboxes. Sustainable operations need roles, groups, access controls and joiner/mover/leaver procedures.

Digital Business Foundation translates the operating requirements into governed digital setup with clear ownership.

• Role — Needed access — Requires separate authorization
• Sales — Assigned opportunities and follow-ups — Payroll or system configuration
• Finance — Invoices and approved ledgers — Other departments’ access policies
• System administrator — Provisioning within delegated scope — Commercial approval on management’s behalf