Access and responsibility
Who approves a change in access when responsibilities move?
A staff change should trigger an understandable decision about permissions, rather than a copied account.
A colleague moves from handling customer requests to reviewing internal reports. The easiest technical change is to add new permissions and leave the old ones in place. Over time, the account can accumulate access that no longer matches the person's work.
Make responsibility the starting point
Use a fictional small Estonian organisation and one staff move. List the tasks the person will perform, the information needed for those tasks and the person authorised to approve access. A job title by itself may not answer those questions.
Distinguish an employee's business role from the system's permission settings. The application should represent an approved arrangement, not invent the organisation's authority structure because a convenient checkbox exists.
Include removal in the same request
A change record can show access to add, access to remove and anything requiring further review. RIA's guidance for managers emphasises organisational responsibility alongside technical security. That supports treating an access change as a managed business event rather than a casual account edit.
Consider temporary cover separately. If a colleague needs additional access during an absence, define who reviews it when the cover ends. Do not make every temporary exception a permanent expansion.
Check the resulting tasks
After an authorised test change, verify that the new role can complete its agreed work and cannot still use a restricted old route. Include direct links and exports, not only the menu. A hidden button does not by itself establish that access is blocked.
A customer or staff workspace should include this change process from the start. The useful deliverable is a permission arrangement the organisation can explain and maintain, with appropriate specialist review where needed.
Further reading: RIA guidance on management responsibility.