Almost every ERP rollout in a small company starts with the same shortcut: "let's give everyone full access for now, we'll sort it out later." Later never comes. Two or three years in, nobody knows anymore who can see what, who's allowed to delete invoices, and why the account of Anna, who left in 2023, is still logging in from some IP address in Warsaw.
This isn't a security-paranoia problem. It's a housekeeping problem. In an SME where a dozen or so people from different departments live inside the ERP, permissions decide who sees your margins, who can pull a payroll report, and who — deliberately or accidentally — wipes a customer record together with its whole order history.
A role matrix is boring, clerical work. Which is exactly why almost nobody does it. This piece is about how to do it once and keep it alive.
What happens when nobody watches this
Three typical scenarios, all seen at clients in the last two years.
First — a 30-person building-materials wholesaler on Comarch Optima. The rollout was done by an outside vendor in "get it into production, we'll tidy up later" mode. Two years on, we checked the account list out of curiosity. There were 22 active logins for 27 people touching the system. Of those, 18 had a profile close to administrator — they could edit price lists, delete documents, issue credit notes without approval. Three accounts belonged to people who hadn't worked there in over a year.
Second — a 15-person design office on Subiekt GT. A sales rep, before leaving for a competitor, spent a week exporting customer records and order history. Nobody noticed because he had standard "sales rep = full access to sales" permissions. There wasn't even a log of who exported what.
Third — a 40-person manufacturer on enova365. A new hire in accounting, as part of onboarding, was given a copy of a long-time colleague's permissions. Everything was copied — including access to the HR module she didn't need but which nobody removed. She could see everyone's salary, including her managers'. It came out at the next audit.
None of these situations comes from bad faith. All of them come from the fact that nobody had the duty or the time to organise this.
Least privilege, in plain language
The canonical security principle says: every user has access only to what they actually need to do their job — and not a gram more. For an SME we translate it more simply: if you can't explain in one sentence why someone needs a particular module, they shouldn't have it.
A sales rep needs sales, the customer file, and the history of their own orders. They don't need HR, they don't need to edit the price list (see — yes, edit — no), they don't need the company-wide margin report. A warehouse worker needs stock documents and product records. They don't need accounting or full sales.
That sounds obvious until you sit down to configure it in a real system. That's when it turns out "sales rep" isn't one role but four: junior rep without margin access, senior rep with margin, key account manager with access to special discounts, sales manager with authority to approve credit notes.
How to build the matrix
The matrix is a plain table: rows are business roles, columns are ERP modules (or functions within modules), and each cell says what that role can do — usually in CRUD terms (read, create, update, delete). Eight to twelve roles and fifteen to twenty columns fit sensibly on one A4 page. More than that means you're complicating things pre-emptively.
A sensible minimum set of roles for a 20–50 person company:
- Sales rep (junior/senior). Sales, customer file, quotes, but no finance module and no company-wide margin.
- Sales manager. All of the above plus approving credit notes, team margin reports, editing price lists within a defined range.
- Warehouse worker. Stock documents, product records (read-only), stock counts.
- Warehouse manager. The above plus location setup, approving stock-take differences.
- Accounting. Invoices, VAT registers, financial reports, tax filings. No HR module, no rights to change price lists.
- HR and payroll. HR module only — and only for the people they actually handle.
- Executive / owner. Full read of everything, edit only where they genuinely do something.
- System administrator. Configuration and permissions. A separate, named account — don't share it between people.
Rule of thumb: if a person does something in the system that no other person in the company does — that's not a role, that's an exception. Exceptions are fine to have, but they need to be documented.
A quarterly review so this stays alive
A matrix built once and dropped into the "documentation" folder ages within six months. People join, people leave, someone gets promoted, someone starts wearing two hats. Without a review ritual, you're back where you started.
A simple pattern that works at clients:
- Once a quarter, export the list of active accounts from the ERP.
- Compare it against the HR list of current employees. Accounts of people who no longer work here get disabled the same day.
- For every remaining account, mark its current role and compare against actual permissions. Discrepancies — fix them.
- Note down the date, who did the review, how many accounts were disabled, how many roles were corrected. That's it.
At the building-materials wholesaler from the first example, after introducing 6 business roles and one full review, the number of accounts with administrator-level rights dropped from 18 to 4 (owner, two managers and a named admin account). Ex-employee accounts — from 3 to 0. The review now takes them about an hour per quarter.
Common mistakes
- A generic "office" or "till" account. Five people log in with it, typing a password they read off a wall. The logs don't show who did what. Always named accounts.
- Copying permissions "just like Mary's". Mary has worked here 12 years and collected access in layers. Cloning that in one click guarantees the new person gets too much.
- "Temporary" cover during holidays. Someone goes on leave, someone else "just in case" is granted their access. Nobody removes it when they come back. If you must, set a calendar reminder for their return date.
- Administrator = one person, one password. When that person is sick or leaves, you have a problem. Minimum two named admin accounts, credentials stored in a password manager, an emergency procedure.
What next
Start with three questions to the team (or to your IT provider):
- How many active ERP accounts do we have, and how many people actually use the system?
- How many of those accounts have permissions close to administrator?
- When was the last time someone walked the account list and reconciled it with the list of employees?
If the answers are "no idea", "probably everyone" or "never" — that isn't unusual, that's normal. But it's exactly the moment to sort it out once, before it gets sorted out for you by an auditor, an ex-employee or ransomware. If you'd like to do it properly and without weeks of work, we help SMEs put role matrices in order on a regular basis. The first call is free and takes half an hour.
"Let's give everyone full access, we'll sort it out later" is the sentence after which a company's "later" always begins.