Least privilege means giving each person only the access needed for their work. Apply it to the tools the supplier actually provides; do not assume a reseller panel has subaccounts, role controls or audit logs merely because another platform does. Where granular controls are absent, reduce the number of people who hold privileged access.
Map tasks before permissions
Quote preparation, customer support, payment review and account changes have different needs. Write those tasks down before sharing a master login. A role label is useful only if the tool really enforces the associated limits.
Avoid shared privileged credentials
A shared login makes it harder to attribute actions and remove one person’s access. Use individual accounts where supported. Protect privileged accounts with the security features actually offered and keep recovery methods under the owner’s control.
Review access after changes
People can accumulate permissions as duties change. Periodically compare current access with current responsibilities. Remove obsolete exports and shared links as well as account permissions; downloaded data can outlive the original access grant.
A practical sequence
0 of 3 steps completed on this page.
An example to work through
A person who only prepares quotes does not automatically need the ability to alter customer access. If the supplier offers no limited role, do not pretend the quote role is technically enforced.
Questions about this topic
Does this confirm Pro Max has role-based subaccounts?
No. Available controls must be confirmed with the supplier.
Is a written role label enough?
No. The access mechanism must actually enforce the restriction.
