Granting access is one thing. Deciding what someone is allowed to do is quite another. If everyone can get everywhere and do everything, you do not have control but a risk. Not because your employees cannot be trusted, but because a mistake or misuse would otherwise have too big an impact. That is why the second edition of The Digital Compass puts authorisation centre stage.
Never work with admin rights by default
For almost every organisation, including small ones, the account you use every day should not have admin rights. Not even for the administrator. In practice this still happens a lot, because it is “handy for the IT person” or “practical for updates”. But it is one of the biggest risks in organisations.
Imagine: an employee receives a convincing phishing email that appears to come from Microsoft 365. He clicks, logs in on a fake page, and without noticing, an attacker has taken over his session. With a normal account, that mainly gives access to email. Annoying, but manageable.
If that account also has admin rights, a completely different scenario unfolds:
- direct access to every system the rights reach
- the attacker can create new accounts
- software can be installed unnoticed
- settings can be changed
- security can be switched off
- backups can be deleted
One click can then lead to full control over your environment. No advanced hack is needed. You hand over the keys to the kingdom yourself.
The solution: two accounts
Use a normal account without special rights for daily work, and a separate account for admin tasks, such as adding a new employee or changing settings. Give that admin account a strong, unique password and two-step verification. Because you rarely use it, it is much less likely to fall victim to phishing. In Why you should arrange your digital foundation now you can read how this works in Microsoft 365.
Role-based access
A good authorisation model is clear, scalable and logical. It has to work now, but also when many new colleagues join later. That is why we recommend role-based access (RBAC): you assign rights per job role instead of per person.
A new HR employee, for example, gets the role “HR employee”, with a fixed set of rights for the data and functions that belong to the job. Do all HR employees need something extra? Then you adjust the role once and it applies to everyone straight away. That way nobody quietly builds up their own, uncontrolled rights.
Roles also make it easy to separate duties. Whoever creates an invoice cannot approve it. Whoever proposes a technical change cannot push it through directly. A good model follows the principle of least privilege: exactly enough access, never more.
Periodic review
Authorisation is not a one-off setting. Rights someone once received but has long stopped needing are a risk. So review the rights granted at least every six months, and adjust them immediately when someone changes roles. Old rights are removed. That keeps risks small and manageable.
Not bureaucracy, but risk reduction
Authorisation can feel like paperwork, but it is one of the most effective ways to limit damage. With clear roles, separated responsibilities and regular reviews, you build an organisation that stays secure and manageable, even as it grows. Good logins are part of that too: read A password policy that actually works.
More in The Digital Compass
This article is based on the second edition of The Digital Compass (in Dutch), about the foundation of a secure digital organisation.
