Access control answers a simple question: who can do what, to which information? In small systems the answer may be obvious. In organisations with departments, branches and approval chains, it needs careful design.
Roles, permissions and scope
- Permissions are individual actions, such as “view invoices” or “approve payments”.
- Roles group permissions that belong together, such as “accounts clerk” or “branch manager”.
- Scope limits where a role applies, such as one branch, a region or the whole organisation.
Combining roles with scope lets the same role mean “manage this branch” for one person and “manage that branch” for another.
Start from real responsibilities
Base roles on actual jobs and responsibilities, not on individual people. Interview representatives of each group to understand what they need to see and do. Avoid creating a new role for every exception; too many roles become impossible to manage.
Apply least privilege
Give each role only what it needs. It is easier to add a permission when someone needs it than to discover later that broad access has been misused or exploited.
Separate sensitive duties
For financial and administrative actions, avoid giving one person control of an entire process. For example, the person who creates a payment should not be the only person who approves it.
Enforce on the server
Hiding a button is not access control. Every request must be checked on the server, so that data cannot be reached by guessing a link or calling an API directly.
Plan for administration
Decide who can assign roles and at what level. A branch administrator might add staff to their own branch but not elsewhere. Keep a record of role changes.
Review access regularly
People change jobs, take on temporary duties and leave. Schedule periodic reviews where managers confirm that their team’s access is still appropriate, and remove access promptly when someone leaves.
Test permissions
Include access rules in automated tests. Check not only that permitted users can act, but also that others cannot.
Well-designed access control protects information without getting in people’s way. It should feel natural to users and be clear to administrators.
