Step 1 of 7
Grant access by job, not by example
What happens
Ask for access in terms of a person's duties and the places they cover, and give them only that.
Good looks like
"Night supervisor, hot kitchen: can enter and review cooking records there."
How it goes wrong
"Set them up like Sam." Sam has been here six years, and has picked up every permission along the way.
Who
Technical
This principle is known as . Keep a note of why each person has their access, because most systems don't record it for you. Check from the person's own login that they see only what they should.
A.5.15, A.5.18