Most permission problems inside a company do not come from an outside hacker. They come from an employee who can see or change more than the job requires. When everyone is an admin, nobody is accountable and the system log tells you nothing. Fixing it is a management decision: who is allowed to do what, and who signs off.
Here is a practical way to set it up in one session with your system admin, then keep it alive every quarter.
Do not attach permissions to individuals. Attach them to job roles: accountant, purchasing officer, sales rep, branch manager, system admin. A person holds a role. When they leave, you remove the role instead of trying to remember what they had.
Five or six roles cover most mid-sized Kuwaiti companies. If you are creating a new role every month, the problem is your process design, not the software.
The mistake we see most often is giving everyone admin, usually in the first weeks of a new system so nobody gets blocked. The result: anyone can delete an invoice or change a price, and nobody can tell you who did it.
Give each person the minimum access their daily work needs, and add more only when there is a real request. A sales rep does not need to see purchase cost. An accountant does not need to edit selling prices.
Temporary access should carry an end date: cover someone's leave for a month, then let it expire instead of sitting there for years.
The part most companies skip is separation of duties: whoever creates a supplier should not be the one who approves payment, and whoever enters an invoice should not be the one who signs it off. This is not distrust, it protects the employee as much as the company.
Approval should follow a named path: the line manager requests, the process owner such as the senior accountant or operations manager approves, and the system admin implements and records it. Written requests only, not a verbal "give me access and I will explain later".
Any decent system records who logged in, who changed what, and when. Review it monthly with a narrow focus: payment orders, price changes, deleted invoices, and customer data exports.
Shared logins kill that log: if three employees use one account, the record names the account, not the person. One account per employee, even when the work is shared.
In Q8DM we start every internal system from the permission log before screens and reports: a wrong permission found after a year of live data is far harder to untangle.
The most common hole: someone resigned last year and their account still works. Keep a fixed exit checklist and run it the same day:
Then review quarterly: print the user list with roles and walk it line by line with each department head. Half an hour every three months prevents most surprises and surfaces the accounts someone forgot.
If you want an internal system built on clear roles and permissions from day one, talk to us at q8dm.com.