Who should see what? Setting access by role in your consultancy

Not everyone in your office needs everything. A counselor needs student files; accounts needs finance; only admins need to manage the team.

Start from the job, not the person. Write down what each role does every day, then grant only those modules.

Review access when someone changes role or leaves. Stale permissions are the most common way sensitive data spreads further than intended.

Pair roles with file locking: once a file is final, it stops changing for everyone, whatever their role.