A short guide to access control

It comes up on almost every project, usually later than it should. Everything we would tell a client about access control in the time it takes to drink a coffee.

Security is a maintenance habit rather than a purchase, which is why it drifts. The teams that stay on top of it are the ones who put it on a calendar rather than a wish list.

What it costs to ignore

Give the least access that lets someone do their job. It is worth being explicit about, because assumptions differ quietly. The version that survives contact with a real deadline is the simple one.

The practical version

Review who has access when people change roles. The cost of getting this wrong is rarely visible on the day it happens. Most teams find the first pass takes an afternoon and the maintenance takes minutes a month.

Warning signs

Shared logins destroy accountability. This is the sort of thing that compounds, quietly, in both directions. The teams that stay on top of it are the ones who put it on a calendar rather than a wish list.

What this looks like day to day

The cheapest security work is the boring kind done on a schedule. Three things worth confirming about access control before you move on:

• Someone can say what the current setup is without going to look
• Give the least access that lets someone do their job — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If any of that sounds like a description of your current setup, it is fixable.