A role matrix before technical setup
First list business actions: viewing a member, changing a membership, recording a payment, exporting data, changing prices, managing staff and viewing audit records. Then mark viewing, entry, editing, approval and export permissions for each role. This matrix reveals excessive permissions before they enter the system.
Least privilege means an account receives only what it needs for normal tasks. Temporary access for cover or special work should have approval, an expiry date and subsequent revocation. Shared accounts make it difficult to establish who changed something and should be avoided.
- give each person an individual account
- separate operational and administrative actions
- restrict exports and bulk changes to a small number of roles
- document the approver and the expiry of temporary access
Joining, changing roles and leaving
Access control is not a one-off setting. Confirm the role and responsible person when someone joins; remove old rights before adding new ones when their job changes; deactivate the account within the agreed time when they leave and check active sessions or integrations.
Periodic reviews should cover active accounts, administrators, export permissions and unusual changes. Audit records provide evidence, but your organisation must define who reviews events, what counts as a deviation and how incidents are escalated.