Give People the Information They Need, With Appropriate Permissions
Yes. Zebsoft supports role-based access arrangements
that can be configured around your organisation’s
responsibilities and information needs.
Decide who needs to read information, who can change
it and who has authority to approve it. These are
separate responsibilities and should be considered
separately during configuration.
The permission model should make approved information
available to the people who need it while restricting
sensitive material appropriately.
Start With Responsibilities and Information Sensitivity
Before configuring access, identify the information
involved, how it is used and the consequences of
inappropriate disclosure or modification.
- Who needs the information to perform their work?
- Who owns its accuracy and maintenance?
- Who should review and approve changes?
- Does it contain personal, confidential or commercially sensitive information?
- Do contractual or other applicable requirements affect access?
- Do external users need access to any part of it?
Use these answers to define the required roles,
permissions and approval responsibilities. Confirm
how the agreed rules apply to your configured records
and workflows.
Separate Reading, Editing and Approval
A person may need to read a work instruction without
being authorised to revise or approve it.
Similarly, a document owner may prepare a revision
that requires review by a specialist and approval
by another authorised person.
- Reading: access to information needed for the role.
- Editing: authority to prepare or maintain content.
- Review: responsibility for checking suitability and accuracy.
- Approval: authority to accept information for use.
- Administration: responsibility for managing the agreed access arrangements.
Agree these distinctions during configuration and
test them using representative accounts before
relying on the arrangement.
Example: An Instruction and Its Supporting Assessment
A team needs an approved work instruction to complete
an activity. The supporting assessment also contains
information intended for a smaller group of responsible
managers and specialists.
The required arrangement might allow the team to
read the instruction while limiting access to the
supporting assessment. The document owner prepares
revisions, and an authorised approver decides when
the instruction is ready for use.
This is an illustrative access requirement.
Confirm the available configuration and how linked
information behaves as part of implementation.
Review Access When Responsibilities Change
Access needs can change when someone joins, changes
role, provides temporary cover or leaves the organisation.
Establish a clear process for requesting, approving,
changing and removing access.
- Identify who authorises each access change.
- Check that permissions match the current responsibility.
- Review temporary arrangements when they end.
- Remove access that is no longer needed.
- Periodically review sensitive and privileged access.
Include external users and contractors where
they form part of your operating model.
Check the Access Arrangement in Practice
A permission setting needs to be tested against
the intended outcome.
- Use representative accounts for the relevant roles.
- Confirm users can reach the information they need.
- Check that restricted information remains inaccessible.
- Test editing and approval responsibilities separately.
- Examine relevant links, searches and available outputs.
- Record issues and retest after changes.
Repeat appropriate checks after significant changes
to roles, configuration or information structure.
Internal audits can examine whether access decisions
remain appropriate and whether the organisation
follows its access-review arrangements.
Consider Copies Outside the System
Where information can be downloaded, printed or
shared elsewhere, define how those copies should
be handled.
Changing a user’s access in the system does not,
by itself, retrieve a copy they already obtained.
Use appropriate handling instructions, contractual
arrangements and other controls for the information
involved. Include these considerations when agreeing
your access model.
Access Control Supports Document Control
Permissions are one part of managing information.
They work alongside document ownership, version
control, review, approval and communication.
People should be able to identify the current approved
information for their work, while changes follow
the agreed controlled route.
Common Questions
Can someone read a document without editing it?
Reading and editing requirements should be defined
separately in the permission model. Confirm and test
the required arrangement during configuration.
Can access reflect different organisational roles?
Yes. Role-based arrangements can support different
responsibilities. The required scope and permissions
should be agreed against your operating needs.
Can external users access information?
Discuss the external users, information and activities
involved so the appropriate portal and permission
arrangements can be assessed.
Will restricted access guarantee information security?
No. Access control contributes to information
security alongside suitable handling practices,
technical measures, training and ongoing review.
Tell Us Who Needs Access to What
Describe the information you need to manage, the
people who use it and the restrictions that matter.
We can discuss the configuration needed to support
those responsibilities.
Use the floating Request more information
button to ask a question, or book a demonstration.
Leave A Comment