When a team is small, giving everyone access to everything feels efficient. Everyone can see the full picture. There are no bottlenecks around permissions. The downside — that your junior sales rep can see salary data, or that a client-facing account manager can see another client's invoice history — is easy to ignore when the team is five people who all trust each other.
At 20 people, this becomes a real problem.
What goes wrong without role-based access
- Employees see salary or HR data that creates internal friction
- Client-facing staff can access other clients' project or financial information
- New hires are given access to everything and leave with more than they should
- Audit trails don't exist — you can't see who changed what or when
- Finance data is accessible to people who don't need it and can't contextualise it
What a well-implemented access model looks like
In a 20-person agency, you need at least five distinct access levels: executive (sees everything), finance (sees all financial data, limited HR), account management (sees their assigned clients only), production (sees tasks and files, no finance), and client (sees their own projects and invoices only). Anything fewer than this creates either security gaps or unnecessary friction.
The client isolation requirement
The most overlooked aspect of agency access control is client isolation. When multiple clients exist in the same system, the data of Client A must be completely invisible to Client B — including in the client portal. A client logging into your portal should only ever see their own projects, invoices, and files. If your current tool doesn't enforce this at the data layer, you have a liability.
Beyond access: audit trails
Role-based access tells you who can see what. Audit logs tell you what they did with it. For any service business handling sensitive client data, financial records, or confidential HR information, audit trails are not optional. When something goes wrong — a data dispute, an unauthorised change, a billing error — you need to know what happened and who was responsible. That requires a system that logs every action at the record level, not just the login level.