Access Control Policy
People should have access to exactly what they need for their job, no more, and only for as long as they need it. This is called least privilege. This policy sets out how access is given, reviewed and removed.
Document
Policy number
TSS-IT-11
Version
1.0
Effective from
1 September 2026
Next review
March 2027
Owner
IT Team
Approved by
Board of Directors
Applies to
Every employee, trainee and intern, and anyone else with access to a TSS system, application, repository, database or cloud account, a client system we are given access to, or the office.
Issued by
Thakur Systems & Structures Private Limited, CIN U62011PN2026PTC254650
Related policies
Password and Authentication Policy (TSS-IT-03), Information Security Policy (TSS-IT-02), Software Development and Change Management Policy (TSS-IT-10), Cloud and App Use Policy (TSS-IT-07)
1. PRINCIPLES
Least privilege. The minimum access needed for the job.
Need to know. Access to a client’s data only for the people working for that client.
Based on role. Standard access is set by role, and anything extra is requested when it is needed.
Your own account. One person, one account. No shared logins.
Separation of duties. The same person should not both make and approve a high-risk change, such as releasing their own code to production or approving their own expense claim.
2. STANDARD ACCESS BY ROLE
| ROLE | NORMALLY HAS | NEEDS APPROVAL FOR |
|---|---|---|
| Trainee during induction | Workspace account, email, chat, training material, read access to selected repositories | Anything else |
| Intern | Workspace account, email, chat, and the repositories and development environments for their assigned work | Production access, client systems, Restricted data |
| Intern under 18 | Workspace account, email, chat, and the repositories and development environments for their assigned work, with sample or test data only | Never given: production access, client personal data or client confidential information |
| Developer | Workspace, email, chat, project tools, repositories for assigned projects, development and staging environments | Production access, client systems, Restricted data |
| Team lead | Everything a developer has, plus admin rights on their own projects and staging releases | Production admin rights, billing |
| HR team | HR records and payroll inputs | Technical systems beyond what the role needs |
| IT team | Admin rights on company systems, through separate admin accounts | Client systems, under each client’s rules |
| Directors | Owner-level access to company accounts, billing and the emergency vault | Not applicable |
3. JOINING, MOVING AND LEAVING
Joining. The HR team tells the IT team before your start date. The IT team sets up the standard access for your role on your first day. Anything extra is requested by your team lead.
Moving. When your role or project changes, your team lead tells the IT team, and access you no longer need is removed within five working days.
Leaving. All access is removed by the end of your last working day, or immediately if someone leaves suddenly. The IT team also changes any shared secrets you knew, transfers ownership of your files and repositories, and collects your devices.
Trainees who do not continue. Access is removed at the end of their last day of training.
Interns. Access is removed at the end of the last day of the internship.
4. ASKING FOR ACCESS
Ask the IT team, saying what access you need, to which system, why, and for how long. Your team lead approves it. Access to Restricted data or to production also needs approval from the tech lead or a Director. The IT team keeps a record of every request and approval.
5. ADMIN AND PRODUCTION ACCESS
Admin rights are used only through a separate admin account, never your everyday account.
Admin accounts always use the strongest available MFA, a passkey or security key where possible.
Production access is time-limited: it is granted for a task and then removed. Every admin action is logged.
Nobody has admin rights on their own laptop by default. If you need to install approved developer tools, the IT team will set up a way for you to do that.
6. ACCESS REVIEWS
Every three months, team leads and the IT team review who has access to what, and remove anything that is no longer needed. Admin and production access get the closest look. Accounts with no sign-in for 60 days are disabled.
7. CLIENT SYSTEMS
Access to client systems follows the client’s rules and contract as well as ours. Request it through your project lead, use it only for that client’s work, and give it up as soon as the work ends.
8. REMOTE ACCESS
Reach company systems from outside the office only in approved ways: on your company device, with your company account and MFA, and through the company VPN where one is provided. Do not install remote desktop tools such as AnyDesk or TeamViewer without the IT team’s approval, and never give a stranger remote access to a company device, whoever they say they are.
9. OFFICE ACCESS
Office keys and access cards are issued by the HR team, recorded, and returned when you leave. Report a lost key or card on the same day.