Getting Permissions Right Without Making Work Harder

Restrictive beats permissive, until it does not

Access control fails in two directions. Too permissive and everyone can see everything, which becomes a problem the day it matters. Too restrictive and people share logins, which destroys the audit trail entirely.

The second failure is more common and less visible. If getting access takes three days, someone will lend you theirs.

Design by role

• Define roles that match how the business actually works, not the org chart
• Grant to roles, assign people to roles — never grant to individuals
• Default new roles to the minimum and add deliberately
• Keep the number of roles small enough that people understand them

Individually granted permissions are impossible to review and impossible to reproduce for a new starter, which is how permission sprawl begins.

Make requesting access fast

The security control that matters most is not the restriction, it is the speed of the exception. If a legitimate request is granted in an hour, nobody shares a login. If it takes a week, everybody does.

A simple request route with a named approver and a same-day expectation prevents more circumvention than any policy.

Review quarterly

Permissions accumulate. People change roles and keep the old access, projects finish and access persists, contractors leave and nobody removes them.

1. List who has access to each significant system
2. Ask each manager to confirm their team's list
3. Remove anything unconfirmed rather than waiting for a justification
4. Check for accounts belonging to people who have left
5. Record that the review happened, which matters for audits and insurance

Privileged access deserves separate treatment

Administrator accounts should be separate from daily-use accounts, protected with multi-factor authentication, and used only when needed. Shared administrator credentials should be in a password manager with access logged.

Also keep a documented emergency access route. Being locked out of your own identity provider on a Saturday is a specific and avoidable disaster.

Frequently asked questions