A new employee needs to finish a task, so someone gives them the same permissions as a colleague. A few months later they move into another role, but the old access stays. Repeat that process often enough and the permission list stops looking much like the company.
Least privilege means giving people and systems the access needed for their responsibilities, rather than broad access by default. It should not be an excuse to make every small task difficult. The practical work is to understand the job, choose the right permissions, and provide a sensible way to request a change.
Start with the responsibility, not the job title alone
Two people with similar titles may handle different information. Ask which applications, shared folders, mailboxes, and administrative functions each role needs. Identify the person who can approve access to the business information. IT can implement permissions, but the business needs to explain who should have them.
NIST’s Protect function includes identity management, authentication, and access control. For a smaller business, one useful first step is a role-based access list that people can understand and review. Record exceptions separately so a temporary need does not silently become the standard for everyone.
Source: NIST Cybersecurity Framework 2.0
Separate ordinary work from administration
An account used for email and everyday browsing does not automatically need administrator rights. Where the platform supports it, use separate administrative arrangements and stronger protections for privileged actions. Reducing routine privilege can limit what a mistaken click or compromised account is able to affect.
The same thinking applies to applications and integrations. A service that needs one calendar should not receive unrelated access without a reason. Review what a connector can read or change, who approved it, and how access can be withdrawn. Machine-to-machine permissions can be easy to overlook because no employee signs in to them each morning.
- Use named accounts where possible so responsibility is traceable.
- Choose groups or roles instead of repeatedly copying individual permissions.
- Define how urgent access is approved, recorded, and reviewed afterward.
- Review shared credentials and prefer delegated access when an application supports it.
Make changes part of normal employee administration
Onboarding should establish the access someone needs. Role changes should remove access they no longer need, not just add more. Offboarding should consider cloud apps, shared vaults, devices, sessions, and recovery contacts as well as the main email account. Agree who tells IT about each change and when.
RIKR helps with onboarding and offboarding and Microsoft 365 or Google Workspace administration. We use a managed 1Password account in the cybersecurity offering to help organize business credentials. A vault is useful, but removing vault access cannot make someone forget a password they already knew. Shared credentials may still need changing.
Related: why RIKR uses 1Password for business
Check whether people can still do their work
A permission review is not finished if people have to borrow another account to get a task done. Ask what failed, decide whether the access is legitimate, and fix the approved route. Security should provide boundaries people can work within, not create a parallel system of workarounds.
Access control is a continuing process because businesses change. A manageable review and a clear approval route are more useful than a complicated permission design that only one person understands.
Explore RIKR managed cybersecurity
Related: zero trust without the buzzwords
Written by Joshua Price
Back to the blog