The principle
Give each person the narrowest access that lets them do their job. This is not about trust — it is about limiting the blast radius of an ordinary mistake, and making it possible to tell who did what.
What roles control
Roles decide which parts of the system a person reaches. Someone working leads and deals does not need billing or platform administration; someone handling subscriptions does.
Administrative areas — the catalogue, billing, platform settings — are restricted to administrators, and that restriction is enforced on the server rather than by hiding a menu. A hidden button that still works when called directly is not access control.
Individual accounts, always
Every person gets their own login. Shared accounts destroy the only thing an audit trail is for: a record that says who changed a figure and when.
When somebody disputes a change, "it was the shared admin account" is not an answer.
When someone changes role
Change their role rather than creating a second account. History stays attributed to them, and there is no second set of credentials left behind.
When someone leaves
Deactivate the account the same day. Keep it rather than deleting it, so the work they did still has a name against it.
Reviewing
Worth a look every few months: does anyone hold access they no longer need? Access tends to accumulate as people's jobs change, and nobody notices until it matters.