Give only the access needed
A support worker may need permission to view orders, but not to change payments or delete accounts. Extra access increases the harm caused by a mistake or by someone else getting into the account.
Review access as jobs change
When someone changes roles or a project ends, remove access they no longer need. If a task needs extra access, give it temporarily and remove it afterwards. The aim is to protect information without making everyday work difficult.