Start with roles, not people
| Role | Typical access |
|---|---|
| Owner | Everything, including billing and who has access. |
| Admin | Settings, users and all records, but not ownership of the account. |
| Member | Create and update the records they work on. |
| Viewer | Read only, for staff who need to look things up. |
Then think about areas
Some information is more sensitive than the rest: pricing and margins, HR-related records, financial data. A salesperson may not need the service desk; a field technician may not need forecasts. Limit access by area where you can.
Contractors and casuals
Give contractors their own login, never a shared one, with the narrowest access that lets them do the job. Remove it when the engagement ends.
When someone leaves
- Remove their access on their last day.
- Reassign their open deals, tasks and tickets.
- Check recent exports or unusual activity if you have an audit log.
A starting permission plan for a ten-person business
| Person | Role | Notes |
|---|---|---|
| Owner | Owner | Billing, users and everything else. |
| Office manager | Admin | Settings and user management. |
| Sales staff | Member | Customers, leads, deals and quotes. |
| Technicians | Member | Jobs, tickets and the customers they work with. |
| Bookkeeper | Viewer or limited member | Invoices and customer details for billing. |
| Casual staff | Viewer | Look up customers and bookings. |
Review access regularly
Every quarter, look at who has access and at what level. Remove anyone who no longer needs it, downgrade roles that are broader than necessary and check that nobody is sharing a login. It takes ten minutes and closes the most common security gaps.
Permissions and privacy obligations
Limiting access isn’t just about preventing mistakes. If your business is covered by the Privacy Act, you need to take reasonable steps to protect personal information, and restricting access to people who need it is one of the most basic. See our Privacy Act guide.
Shared logins: why to avoid them
A shared login means you can’t tell who did what, you can’t remove one person without changing the password for everyone, and two-factor authentication becomes impractical. Give every person their own account, even casual staff, and remove it when they leave.
A worked example
A building company gives site supervisors member access to the jobs and customers they look after, but not to pricing and margins. The estimator and owner see everything commercial. The bookkeeper can see invoices and customer details. When a supervisor leaves, the office manager removes their access the same afternoon and reassigns their open tasks. Nobody shares a login, and the owner can see who changed what if a question comes up.
Quick checklist
- Give everyone their own login.
- Start from roles: owner, admin, member, viewer.
- Limit access to sensitive areas such as pricing and finance.
- Give contractors the narrowest access they need.
- Remove access on a leaver’s last day.
- Review access every quarter.
How NovaSoft One handles it
Every plan includes owner, admin, member and viewer roles, and the server enforces them, so hiding a button is never the only protection. Business plans add per-area permission controls and a workspace audit log.
Common questions
How many admins should a small business have?
Usually one or two. Enough to cover leave, but not so many that settings change without anyone knowing.
Should contractors get full access?
No. Give them their own login with the narrowest access that lets them do the job.
What is the difference between a member and a viewer?
Members can create and update records they work on. Viewers can look things up without making changes.
This guide is general information for Australian businesses, not legal, tax or financial advice. Check anything specific to your situation with a qualified adviser or the relevant government agency.