Permissions grow by themselves. Employees change departments and keep old rights, projects end and shares remain, providers receive access nobody revokes. A permission concept brings order to this.
Content
Roles based on tasks rather than people; per role the rights in the relevant systems; a process for request, approval and assignment; rules for privileged accounts such as administrators; a procedure for joiners, movers and leavers; and periodic reviews of whether assigned rights are still needed.
Least privilege
Everyone gets only the rights needed for their task, and only for as long as needed. This is the core of zero trust and one of the most effective measures against the consequences of taken-over accounts. It requires discipline, because extra rights are more convenient than a request.
Link to data protection
The FADP and GDPR require data security appropriate to the risk. The permission concept is evidence that personal data is accessible only to those who need it and therefore belongs to the TOMs. In web applications, row level security implements the same principle at database level.
Typical mistakes
Granting rights to people instead of roles. Planning reviews but never carrying them out. Not linking leavers with IT. And forgetting collaboration platforms where sharing happens outside the concept. Before introducing AI assistants that search everything accessible, cleaning up permissions is the most important step.