Levels of Permitted Access

An access level (also called a permission level, or level of permitted access) is a setting that decides what a user is allowed to do once they have logged in. Correct settings mean each person can reach the parts of a system their work needs, and nothing else.

Three typical levels

Read only is the safest of the three levels, because a user cannot damage or remove anything even by accident. Full control is the most powerful and the most risky, since it lets someone lock other people out or wipe stored data, so very few accounts should have it.

Choosing the right amount

The rule to follow is least privilege: give each user the minimum access they need to do their job. Too much access raises the risk, because a careless or dishonest user can then alter or delete information they should never have seen. Too little access causes a different problem, as people cannot finish their tasks and may start sharing logins or asking a colleague with higher access to do the work for them, which weakens security further. Finding the right balance between too much and too little access is important.

For example, in a veterinary practice's booking system, receptionists need read/write access to appointments so they can book and move them, but read-only access to animal treatment records. Vets need read/write on those records to add notes after a check-up. Only the practice manager has full control, so that new staff accounts and access levels can be set up.