Restaurant System Access: Review Permissions Across Outlets

Count assignments, not people

Make one review entry for each combination of account, system and outlet or scope. One person can legitimately hold several entries: a manager may have point-of-sale access at one outlet and reporting access across the group. Counting people hides which of those assignments is still needed.

The result is a list of assignments and their status. It is not a headcount of users, and the worksheet does not calculate one.

Build the inventory before judging it

List every system in scope and every route into it: staff accounts, contractors and vendors, service or integration accounts, shared logins and administrative accounts. Record each shared-access exception with the reason it exists and when it ends.

If you cannot confirm that the inventory is complete, say so. A review of the accounts you happened to find is still useful, but it cannot be described as complete, and no summary should imply that unlisted systems were checked.

Compare approved need with actual permissions

For each entry, record the approved need: which functions and outlets the work requires, who approved it and when. Then record the actual permissions from system evidence, such as a settings view or permission export captured by an authorised reviewer. Write specific functions and outlets, for example void approval at Outlet A, rather than a role label, because two systems can attach different rights to the same label.

Where the two match, the decision is Keep. Where the scope is wrong, it is Change. Where the need has ended, it is Remove. Where evidence or ownership is unclear, it is Investigate, and an open investigation is not an approval.

Worked example: six assignments

In this fictional snapshot, six assignments were reviewed against a confirmed inventory. Three are Verified and three are not yet verified: one Applied, one Requested and one Open. By decision there are two Keep, one Change, two Remove and one Investigate.

A06 stays in the review as a closed record of a verified removal; it is not active access. The snapshot produces no score, percentage or security rating, and no count of unique users.

Requested, applied and verified are different

A request shows that someone asked. Applied means the authorised administrator reports making the change through the provider's own process. Verified means an authorised reviewer, a different person where your policy requires it, has confirmed the result from settings, audit records or a permitted test. A Keep is verified only with evidence that current scope matches the approved need; a Change or Remove is verified only after the result has been checked.

Never ask a former colleague to try logging in to prove their access has gone, and never put passwords, tokens or recovery codes in the workbook. Record a reference to where the evidence is held. This guide gives no click paths or automated commands; each provider's documented process applies.

Before removing access

Check what depends on the account. A departing manager's login may own scheduled reports, a vendor account may run an integration, and a shared mailbox may hold supplier records. Record dependencies, recovery arrangements and record ownership, arrange an authorised handover and confirm how legitimate work will continue.

These checks should not delay an urgent removal. If access must end now, end it through the proper route and complete the handover record afterwards. The review sheet follows the action; it does not hold it back.

Exceptions, follow-up and record handling

Give every open item an owner and a follow-up date, and every exception an expiry. Set your own review frequency from your systems and circumstances; this guide does not prescribe one.

Store account references or pseudonyms rather than personal details. Keep the real register restricted and any shared or public copy fictional. The worksheet records decisions; it does not change access or assess compliance.

Where the principles come from

UK government business guidance on protecting accounts recommends regularly reviewing who can reach business accounts, including former staff, outside consultants and suppliers, and removing logins that are no longer needed. The National Cyber Security Centre's identity and access management guidance describes defining who needs which data and functions and why, managing joiners, movers, leavers and temporary accounts, revoking unnecessary privileges and keeping account actions traceable. Both are used here for general principles only.