An example with three roles
| Role | Sees | Can do |
|---|---|---|
| Owner | Everything, including profit and salaries | Everything, plus managing users and exports |
| Manager | Their branch or department and its reports | Add, edit and approve |
| Staff | Only their own tasks and orders | Add, and edit what they entered |
How to set it up
- 1List the sensitive information
Prices, profit margins, salaries, customer phone numbers. Protect these first.
- 2Define the roles
Three roles are enough for most small companies. Do not create a role per person.
- 3One account per person
No shared accounts. Without a personal account you cannot tell who did what.
- 4Test as an employee
Sign in with a staff account and check that they cannot see what is not theirs, or open it through a direct link.
Rules that protect you
- Give the least permission that gets the job done, and add more when needed.
- Keep delete and export for the owner or manager only.
- Disable an employee's account the day they leave.
- Review the user list every few months.