Key points
- Combine role, property, action and duration instead of granting global access.
- Include temporary cover and contractors in the initial design.
- Test permitted actions and actions that should be denied.
Describe the information and decisions involved
The business owner lists the information requiring control: room tasks, maintenance work, operating standards, consolidated reports or approvals. For each object, separate viewing, creation, editing and approval. Updating an assigned task should not be treated as equivalent to changing a group-wide operating standard.
CNIL highlights access control. The following matrix is a working proposal to compare with actual responsibilities and tools. It does not describe any software’s default permissions. If a required restriction is unavailable, make a documented decision rather than promising a limitation the system cannot enforce.
Build the role and property matrix
| Example role | Scope | View and create | Edit and approve |
|---|---|---|---|
| Room attendant | Assigned tasks, property A | View own tasks and report a discrepancy | Update execution; no approval of group standards |
| Property housekeeping manager | Housekeeping, property A | View and create local assignments | Reassign and approve within responsibility |
| Shared technician | Assigned work, properties A and B | View necessary details and create a finding | Update own work; approval defined separately |
| Temporary contractor | Specific assignment and authorised period | Information required for the assignment | Report limited to that assignment |
| Group management | Summaries for relevant properties | View authorised indicators | Approve decisions within its mandate |
Add an “excluded data” column identifying information the role should not access. This prompts a review of detailed views, exports and attachments. A consolidated report may meet management’s needs without routinely exposing every stay-related note.
Handle joining, temporary cover and departure
An access request identifies the person, role, property, purpose, start and any end date. The business owner approves the need, the administrator configures it and a designated reviewer checks the result. Preserve these distinct responsibilities even where one person performs several functions in a small group.
For temporary cover, use a documented temporary extension rather than copying a manager’s entire account. The assignment’s end triggers removal or reduction of access. A job change also requires review of earlier permissions: adding the new role without removing obsolete rights creates an accumulation that becomes difficult to explain.
Test an allowed action and a denied action
Fictional example: the housekeeping manager at property A covers property B for one week. The owner authorises management of B’s housekeeping tasks, without access to other properties. The test checks an assignment at B and a request to view property C, which should remain unavailable. It then checks that access returns to the A-only scope at the planned end.
Use an authorised test environment or accounts without modifying genuine guest records to demonstrate the matrix. Check available direct links and exports where relevant to the system. If a desired permission cannot be isolated, record the gap and have an acceptable arrangement approved before widening access. The test record should identify what was actually checked rather than making a blanket statement that the system is secure.
Maintain the matrix as the group changes
The review compares active accounts with current responsibilities and assignments. Examine unused accounts, contractors whose work has ended and employees who have moved properties. Set a frequency appropriate to the context and add reviews after material changes; this method does not prescribe a universal statutory interval.
The final working pack contains the approved matrix, configuration gaps and test evidence. Discuss the operational requirements through the solution for multi-property hotel management. Close an access request when its configuration has been checked, then reopen the assessment if the business need, function or property scope changes.
Frequently asked questions
Can all general managers use the same profile?
Only if their needs, properties and responsibilities are genuinely equivalent. A shared title alone does not justify group-wide access.
What if the system cannot implement a planned permission?
Document the limitation and have the need, available configuration and organisational measures assessed. Do not treat an untested restriction as established.