In brief
Separate viewing, editing, approval and administration so everyday work can move without giving every staff member unrestricted access.
A job title is only the starting point
A salesperson may need to prepare a quotation without changing system settings. An operations colleague may need to update fulfilment without viewing every financial field. Start access design with these activities rather than giving everyone an administrator login.
OWASP recommends least privilege, denying access by default and validating permissions on every request. In practice, the system should enforce the rule even when someone reaches a page or record through a copied link. Hiding a button alone is not the control.
Separate the actions that matter
List the important records and distinguish viewing, creating, editing, approving, exporting and administering. A team may need different rules for each.
Next, decide whether a person can act on all records, only their own work or records assigned to their team. Keep the first version understandable enough that a manager can explain it without a technical diagram.
Give approvals a clear state
An approval process should make it obvious what is waiting, who can decide and what changed after a decision. Define whether an edited request needs a fresh approval rather than silently keeping its earlier approved status.
Consider absence and urgent exceptions before launch. A named substitute or documented escalation is easier to manage than informal password sharing. Do not create a bypass that quietly removes accountability.
Test both permission and refusal
A successful test includes a user who can perform the action and one who cannot. Use non-production examples and check the result, not just the appearance of the screen.
- Can a preparer approve their own request when that should be prohibited?
- Can a user open another team’s record through a direct link?
- Does an export include fields the user cannot otherwise see?
- Is an important change traceable to the person who made it?
- What happens when a staff member changes role or leaves?
Keep the rules maintainable
Assign an owner to review access and remove permissions that are no longer needed. The review should consider the person’s current work, not simply copy the permissions they had on their first day.
For a growing SME, clear boundaries reduce the need to interrupt the owner for every action while preserving oversight where the business actually needs it. Start with the few decisions that carry real consequences and expand only when the workflow requires it.
