Create an ICO aligned, auditable user permissions policy for trades and services. Four steps, role matrix, JIT rules and a printable checklist.

Decorative user permissions policy title card

A user permissions policy sets out exactly who can see, create, edit or delete which records in your job and CRM system, and the first thing to do is apply least privilege: give each person only the access their role needs, then write it down. Tools like Pipeline make that easier by letting you assign roles instead of handing out blanket admin rights.

TL;DR:

  • Most small trades businesses should assign permissions based on roles, resisting the urge to give blanket admin rights to reduce risks.
  • Permissions policies must cover all sensitive data areas, including leads, quotes, jobs, invoices, payments, and reports, with roles closely matching job functions.
  • Regular reviews every 6 to 12 months, along with prompt access removal of leavers and role changes, are essential for maintaining security and compliance.
  • Enforcing technical controls like multi-factor authentication, session timeouts, and logging ensures the policy is effectively implemented and monitored.
  • Using role-based tools like Pipeline simplifies assigning permissions, supports audit trails, and keeps financial and sensitive data access limited to necessary staff.
Pipelineapp
pipelineapp.co.uk
Keep Trade Records Under Control
Pipeline brings leads, jobs, quotes, invoices and payments into one platform, with role-based tools for clearer oversight and collaboration.
Get in touch

Table of Contents

What a user permissions policy covers in your software

Your policy needs to cover every part of your system that holds sensitive or financial data: leads, quotes, jobs, invoices, payments and reports. Anything a staff member or contractor can open, change or delete falls inside its scope.

A few terms are worth pinning down so your team uses them the same way. A role is a job function, like Office Manager or Field Technician. A permission is a specific action tied to that role, such as “create invoice” or “view customer contact details”. A privileged account has elevated rights, usually admin-level. Least privilege means giving people the minimum access they need to do their job, nothing more. Just-in-time (JIT) access means granting elevated rights only for the task at hand, then removing them.

Most job and CRM platforms use role-based access control (RBAC), where permissions are bundled into roles rather than assigned one by one. For a trades business, that typically means an Owner or Admin role, an Office role for quoting and invoicing, and a Field role limited to job details and scheduling.

Role based access control for trades teams

Core principles to guide policy design

Least privilege is the rule everything else hangs off. The Cabinet Office’s guidance on least privilege recommends defaulting to the lowest level of access possible and using JIT access for anything elevated, rather than leaving admin rights switched on indefinitely. For a small business, that means fewer accounts that could cause damage if a password leaks or a phone goes missing.

Data protection by default works the same way: decide what a role needs before you create the account, not after someone’s already clicked into an invoice they shouldn’t have seen. The ICO’s guidance on data protection by design treats this as a basic requirement under UK GDPR, not an optional extra.

Finally, build in a review cadence. A full audit every 6 to 12 months, backed by written records, gives you evidence that access is kept current rather than left to drift.

Step-by-step: how to create a simple, auditable policy

You don’t need a long document. You need a short one that actually gets followed. Here’s a sequence that works for most trades and service businesses:

  1. List every system asset that holds sensitive data: leads, quotes, jobs, invoices, payments, reports, customer contact details.
  2. Define your roles (Owner, Office, Field, Contractor) and match each one to the specific permissions it needs, resisting the urge to give everyone admin by default.
  3. Name who approves access changes and write down the rules for temporary or JIT access, including who can grant it and for how long.
  4. Turn on logging, set session timeouts for admin accounts, and decide how long you’ll keep access records and audit logs.

Keep the roles granular. An office administrator handling quotes doesn’t need the ability to delete customer records, and a field technician doesn’t need visibility into payment details.

Pro Tip: Give admin users a separate standard account for day-to-day work, and reserve the admin login strictly for maintenance tasks you can point to and explain later.

Operational rules: joiners, movers and leavers

Your policy only works if it’s followed every time someone joins, changes role or leaves. The ICO’s access control toolkit sets out what auditors expect to see documented.

  • New starters get the minimum role permissions on day one, with any contractor access time-limited from the start.
  • Role changes trigger an immediate rights adjustment, approved and recorded, not left until the next review.
  • Leavers lose access the same day they leave, with the removal logged as evidence.
  • Regular audits and spot checks catch permissions that have quietly grown beyond what a role needs.

Recording each of these steps, even briefly, gives you the accountability evidence the ICO expects if anything is ever questioned.

Technical controls and admin hygiene to enforce the policy

A policy on paper is only as good as the settings behind it. The NCSC’s device-security guidance recommends running software with the lowest permissions required and supporting a granular model so a single compromised account doesn’t expose everything.

In practice, that means requiring multi-factor authentication on every account, separating admin logins from standard ones, and setting short session timeouts on privileged roles. Temporary access should always carry an end date, with JIT access preferred over leaving elevated rights switched on. Audit logging needs to be switched on so you can see who did what and when, and your software’s role-based screens should hide features a user doesn’t need rather than just discouraging clicks. On mobile, limit the app’s permissions on staff phones to what the job actually requires: location for scheduling, camera for job photos, nothing beyond that.

Technical controls and admin hygiene to enforce the policy — overview diagram

Printable checklist for drafting or reviewing your policy

Use this as a quick reference when drafting your policy or preparing for a review.

  • Scope defined: leads, quotes, jobs, invoices, reports all covered.
  • Role matrix written down, with an owner responsible for keeping it current.
  • Review cadence set, ideally every 6 to 12 months.
  • Joiners, movers and leavers process documented and followed.
  • Temporary and JIT access rules written down, with expiry dates enforced.
  • Audit logs switched on and checked periodically.
Evidence to retain Why it matters
List of privileged accounts Shows who holds elevated access at any point
Dated review records Demonstrates regular checks, not a one-off exercise
Joiners/movers/leavers log Proves access was granted, changed and removed on time

Practical benefits for a small trades business

A written permissions policy stops the small mistakes that cause big headaches: a field technician accidentally deleting a quote, or an office temp seeing payment details they never needed. The most common misconfiguration is the shared login, everyone using “admin” because nobody set up proper roles. The second is the field account with full office access, granted once for convenience and never scaled back.

Tools like Pipeline’s team and roles features exist precisely so you don’t have to choose between convenience and control.

— Chris

How Pipeline helps you put the policy into practice

Writing the policy is one job. Running it day to day is another, and that’s where the right software earns its place. Pipeline’s team permissions let you assign roles that match what you’ve already written down, so office staff, field teams and admins each see only what their job needs.

Pipelineapp

  • Role-based access maps straight onto Owner, Office and Field roles without custom setup.
  • Adding staff doesn’t necessarily mean negotiating more licence fees.
  • Audit visibility and invoicing controls help you keep financial records restricted to the people who need them.

Plans are available at different price points, with pricing details provided on the pricing page. Check the full pricing page to see which fits your team.

Sources

For the legal and technical detail behind this policy, these are worth keeping close:

FAQ

What should a user permissions policy include as a minimum?

At minimum, it should list which system assets are in scope, define roles and their permissions, name who approves access changes, and set a review cadence. The ICO’s access control toolkit treats documented roles and review records as the core evidence auditors look for.

How often should permissions be reviewed?

A practical approach for a small trades business is to perform regular quick checks on active users and a full documented audit approximately twice a year to once a year. The Cabinet Office’s least privilege guidance recommends documented periodic reviews as part of a least privilege approach.

What is role-based access control and why does it suit trades businesses?

Role-based access control (RBAC) bundles permissions into roles, such as Owner, Office or Field, instead of assigning each permission individually. This suits trades businesses because it maps naturally to how teams already split their work, keeping setup simple as staff join or change roles.

How quickly should access be removed when someone leaves?

Access should be removed the same day someone leaves, with the removal logged as evidence. The ICO’s guidance on data protection by design treats prompt removal as part of preventing unauthorised access after a role change or departure.

Does Pipeline support role-based permissions for office and field staff?

Yes, Pipeline’s team and roles features let you assign permissions by role so office staff, field teams and admins each see only what they need, with flat monthly pricing regardless of team size.

Recommended