Permissions, Roles (RBAC) and Audit Logs: The Three Line Items That Decide Whether an Ex-Employee Can Still See Your Customer List

The Opening: How Many Doors Does One Keycard Open?

Anyone who has stayed in a hotel understands the rules. The card at the front desk opens your room and the lift, nothing else. Housekeeping's card opens every guest room on a floor but not the safe. Maintenance can enter the plant room but not the accounts office. The manager's card opens almost everything, and every swipe leaves a record. Nobody finds this annoying, because everyone accepts that a hotel cannot let one guest walk into another guest's room.

Move the same idea into a company's own system and it turns into an unreadable line on a quote: "user permission management module: NT$45,000." The owner's instinct is usually the same — "we have twelve people, do we need this?"

You do. Most companies discover how cheap that NT$45,000 was only after a departing salesperson walks off with the whole customer list, or after a quotation amount gets quietly changed and nobody can prove who did it.

Permissions, RBAC and audit logs are simply the three parts of a keycard system: which doors a card opens, how cards are issued, and who opened which door at what time. Miss any one of the three and the other two lose most of their value, which is why they belong in one article.

1. Permissions: Which Door This Card Opens

Plain definition: the individual rules for what a person can and cannot do inside the system.

Hotel analogy: a permission is the lock setting. This card opens room 802, not 803, and definitely not the safe. Behind one card sits a stack of can-open and cannot-open rules.

Business scenario: a building-materials trading company with eight salespeople. In its quoting system, permissions should look like this — sales see only their own accounts and can create quotes but cannot edit the cost-price field; the sales manager sees every account and approves discounts above 15%; accounting sees amounts but cannot change customer contact details; the warehouse sees shipping quantities and no prices at all.

Why it touches your money: permissions that are not properly divided mean every employee is carrying the general manager's master card. The authoritative industry list ranks broken access control as number one in the OWASP Top 10. In owner's language: this is not a theoretical risk, it is the one that most often actually happens.

2. RBAC: Issue the Card to the Job Title, Not to the Person

Plain definition: RBAC (role-based access control) means you define a handful of job titles up front, give each title a full set of permissions, and then simply attach a person to a title.

Hotel analogy: a hotel does not sit down and re-decide which doors each new housekeeper may open. It hands out a housekeeping card. Card issued on the first day, card collected on the last day, no reconfiguration in between.

Business scenario: the same trading company defines five roles — sales, sales manager, accounting, warehouse, system administrator. A new salesperson starts, the administrator clicks "sales," and it is done in thirty seconds. Setting the same thing permission by permission takes twenty minutes and regularly ends up missing something or granting too much.

Why it touches your money: two reasons. First, staff churn. Fifteen joiners, leavers and transfers a year at twenty minutes saved each is five working hours annually — and that is the small part. Second, error rate. The classic failure in a permission-by-permission system is "Chen covered for accounting three years ago, nobody revoked it, and he can still see everyone's salary." RBAC turns that into a single change-the-role action. This is not vendor jargon; it is backed by a formal NIST model and the ANSI/INCITS 359 standard.

3. Audit Log: The Swipe Record Inside the Door Lock

Plain definition: a tamper-resistant running record of who did what, to which piece of data, at what time.

Hotel analogy: when something goes missing from a room, maintenance reads the log out of the door lock — a housekeeping card opened this door at 02:14. Without that record, all you have left is people pointing at each other.

Business scenario: the trading company finds a closed quotation whose value dropped from NT$820,000 to NT$680,000. With an audit log: three minutes to find that account X made the change on 12 March at 17:42, with the before and after values attached. Without one: three people all say it was not them, the owner spends two weeks getting nowhere, and the same thing happens again.

Why it touches your money: an audit log does not prevent the incident. It decides whether you can prove anything afterwards. The larger the disputed amount, and the more you have to explain yourself to a customer, an auditor, a court or a regulator, the more that record is worth.

How the Three Fit Together

In one sentence: the role decides which card you get, permissions decide which doors that card opens, and the audit log records which doors you actually opened.

Order matters too. Define roles first, fine-tune permissions second, switch on the audit log third. Doing it backwards — logging everything while handing out permissions loosely — is installing a camera and leaving the door unlocked.

Five Questions to Ask When These Terms Appear on a Quote

• "Which roles are there? Can I see a role-versus-permission table first?" A good vendor produces one. A vendor who says "we'll sort that out later" usually has not designed it yet.
• "On the day someone leaves, how do we revoke everything at once? How many steps?" The reasonable answer is "disable the account, one action." If the answer is "you have to switch it off in five places," you already know which ones will get missed.
• "What does the audit log record? How long is it kept? Can an administrator delete it?" It should cover at least logins, amount changes, customer-data exports and permission changes, be retained for 6–12 months, and not be editable or deletable by administrators.
• "Are permissions enforced by hiding buttons on screen, or actually blocked on the server?" This is the question that separates real work from theatre. Hidden buttons are bypassed by anyone who can edit a URL.
• "Is this a one-off cost or annual? What does adding a new role later cost?" Get the unit price for future roles agreed now, so every small change after launch does not become a fresh quote.

What It Actually Costs When You Skip It

• The customer list walks out: a salesperson exports the full customer list before resigning. If personal data is involved, Articles 28 and 29 of Taiwan's Personal Data Protection Act allow each affected person to claim NT$500 to NT$20,000 per incident — for 1,000 customers that is a range of NT$500,000 to NT$20 million. Regulators can separately impose fines of NT$150,000 to NT$15 million under Article 48 where a serious violation is not corrected in time.
• Quiet discounting: with no control over who can approve discounts, a company doing NT$4 million a month that gives away an extra 1.5% on average burns NT$720,000 of gross profit a year, and it never shows up as a line item.
• Retrofitting: adding permissions and audit logging after launch typically costs two to three times the hours it would have taken during planning, because table structures change, historical records need backfilling, and every workflow has to be retested. What would have been NT$40,000–80,000 up front routinely becomes NT$120,000–200,000 later.

The Three Misconceptions That Cost the Most

• "We're small, everyone can see everything." Small is exactly why it hurts. In a twelve-person company, a single salesperson often carries 30 to 40 percent of revenue, and the customer list they can export is that 30 to 40 percent. Permissions are not distrust of staff; they protect the employee too, because when something goes wrong they can prove it was not them.
• "We have logins, so we have permission management." Different things. Login answers "who are you." Permissions answer "what may you do." Plenty of systems ship with login done and every user seeing an identical screen underneath.
• "An audit log is just the system log." The log an engineer means is a technical record for debugging. An audit log is human-readable, usable as evidence, and written in business terms ("Wang changed customer A's quote from NT$820,000 to NT$680,000"). A quote that says "logging included" does not mean you are getting an audit log — ask.

Health Check for Your Own System

• ☐ Someone left more than 30 days ago and you are not sure whether their account still works
• ☐ Everyone in the system sees exactly the same screen
• ☐ There is no written role-versus-permission table
• ☐ Anyone can export the customer list or quotation data to Excel in one click
• ☐ Data has been changed and you cannot tell who changed it or when
• ☐ Somebody covered a role temporarily and that access was never revoked
• ☐ The administrator account is shared and several people know the password
• ☐ Amounts, stock levels or discounts have been altered with no explanation found

Ticked 1–2: start with an account audit and a proper offboarding process. Ticked 3–5: redefine roles and add audit logging. Ticked 6 or more: make the permission architecture the top priority in your next system revision.

FAQ

We use an off-the-shelf SaaS product. Does any of this apply?

Yes, except you are managing configuration rather than development. Ask the vendor for a role-versus-permission table and confirm the audit records can be exported. Many SaaS products put audit features behind a higher tier, so check before signing rather than discovering it during an incident.

How much does adding permissions and audit logging cost, and how long does it take?

For a small or mid-sized system, redefining roles plus server-side permission enforcement plus basic audit logging is typically 40–80 hours, NT$60,000–140,000, over 2–4 weeks. Planned in at the start of development, it costs roughly half that.

Will an audit log slow the system down or eat storage?

At typical SME volumes you will not notice. At 5,000 recorded actions a day, a year comes to roughly 1–2 GB, under NT$50 a month in storage. The thing worth attention is retention period and an archiving routine, not performance.

Should the owner hold the highest permission level?

Yes, but not for daily use. Keep the top-level account separate and activate it only when needed, working day to day from a normal administrator account. The reasoning is simple: if the owner's account is compromised the whole system goes with it — and the owner's actions need to be logged too, or the policy carries no weight with anyone else.

Next Step

If you are holding a quote with "permission management" on it, or your system has been live for years and nobody has ever audited who can see what, we offer a one-off Permissions and Audit Health Check: an inventory of existing accounts, a drawn-out role-versus-permission table, the high-risk gaps identified, and an actionable remediation list with pricing.

• Email: [email protected]
• Phone: 0916-224-047
• LINE: @ufv9089p