Plain definition
Access control governs who can enter systems, see information, create or change records, approve actions, and administer other users. Good access is based on a role and a real business need, is limited to the minimum needed, and changes promptly when a person moves or leaves. It is a practical expression of authority and segregation of duties.
A password policy alone is not access control. The design also needs approval for access, secure authentication, periodic review, logging of sensitive activity, and a route to remove emergency or temporary privileges.
Illustrative example
Suppose a newly promoted sales manager asks for access to the customer-pricing table so the manager can approve discounts. The system administrator receives an approved role request that grants price-view and discount-approval access but not the ability to change tax codes or create customer bank details. Three months later the manager moves to operations; the access review identifies the old sales role and removes it.
The decision is based on the work the person must perform, not on their title or seniority. The company reduces the chance that a former role’s permissions are used to alter information unrelated to the new job.
Access controls need monitoring for privileged accounts and shared credentials, which can undermine otherwise well-designed roles.
Why it matters
They protect confidential information and reduce errors or misuse caused by unnecessary system powers.
They let management test whether the system’s actual permissions match the organisation’s stated decision rights.
Practical consequence
Review a sensitive role by listing the screens, data, and actions it can use, then remove permissions that do not support a current task.
Reconcile active accounts to HR role changes and leavers, and investigate administrator or emergency access that remains open longer than intended.