Assign your own roles without sharing super admin rights

Why full rights are so tempting

A new colleague is to work in Zscaler operations. She needs access, otherwise she cannot start. The question of which rights exactly takes time to answer and has to be asked again for every special case.

Full rights solve that immediately and completely. They always work, for every task, without adjustment. That convenience is the real reason administrator accounts multiply, not carelessness.

The price falls due later, and elsewhere: in an audit conversation, in an incident analysis, or the moment someone accidentally changes something they never meant to touch.

The real benefit is not security

Graded roles are usually treated as a security topic. That falls short. Their greater benefit is that they make delegation possible at all.

As long as any involvement requires full rights, every handover of a task is a risk decision. Can the service desk take on this diagnosis? Only if they become administrators, so better not. The task stays with second level, even though it does not belong there.

With graded rights, the risk question becomes a scoping question: which view does this role need to do this job? That can be answered, and the task can then go where it is handled efficiently.

Reading is the most common requirement

A large part of daily work consists of looking things up. Where is it stuck, which rule applies, what is the state of this device. None of that requires write access.

That observation is the most practical shortcut to a sensible role design. Separating the reading activities from the writing ones solves most of the problem, without having to design a fine-grained rights model.

What happens to the write permissions

For changes, the question of who may carry them out remains. A second layer helps here: not every change has to take effect immediately. Critical interventions can be tied to a four-eyes approval.

This decouples the right to prepare a change from the right to release it. A junior colleague can work without every change going live at once, and learns on real cases while doing so.

What the account list says about the organisation

A good first step is a plain question: how many accounts hold full rights, and how many people actually need them daily? The gap between the two numbers is usually larger than expected.

That gap is no reproach to anyone involved. It is the predictable result of full rights being the path of least resistance. Closing it is therefore less a matter of discipline than of tooling.