Locked out of the bathroom

Imagine coming home to find that your key no longer opens the front door.

Or maybe it opens the front door, but for some reason you need (suddenly) a completely new key to get into the bathroom.

What the heck is going on?!

OK, that’s unlikely.

But you could be putting your website users in a similar position -- staff, members, and anyone else -- if you're not careful about making changing to user permissions on your website.

That's because your site permissions aren't quite as simple as managing access to rooms in your own home.

It's more like managing all the locks on all the doors in a large office building:
The maintenance crew needs to access the bioler room, but not private offices.
Tenants need to access their private offices and the front door, but not the loading dock.

Switching up the access controls on any of those, if not done carefully, could grant too much access to the wrong people, or prevent critical access for people who really need it.

Would you really want the general public having access to your building’s critical infrastructure?

That's why it's important to document your access levels:
What are the different access levels you need to maintain?
What should each one be able to do?
Can we assignmore than one access level to any given user?
Who's affected if we change the permissions for this access level?

Maybe you're not sure how to get started with this.
Maybe it feels low-priority for now (and won't become a priority until someone has a problem).

But you can start addressing this now, without taking a whole day out of your week and calling meetings with 13 different people.

1. Here's a sample document that can serve as a template.
You can copy that document, add, remove, and edit sections to describe your needs.
Then consistently refer to it going forward, and update it over time.

2. You could just take 15 minutes to list out what you think are the various access levels.
Keep that handy, and work to improve and flesh it out (by referring to it and updating it) over time.

Either way, I expect it's worth a few minutes of your time.

Definitely better than finding out you've given the general public access to your building's elevator control room.

All the best,
A.