Employee Access Control — Who Sees What

When we talk about the risk of a currency exchange, the mind goes to a forged voucher, a wrong rate, or a delinquent customer. But there is a quieter and often costlier risk: internal risk. An employee with access to everything, an employee who both records and approves, a change to a document that leaves no trace of itself. This article is about the three pillars of internal access control: the principle of least privilege, segregation of duties, and the activity log.

Why access control, not trust

Let us set aside a common misunderstanding. Access control does not mean distrusting employees. It means building the system so that even if someone wants to make an error or a mistake, they cannot do it alone and without a trace. This is the difference between "I hope no one makes a mistake" and "the system does not allow a traceless mistake."

In accounting, trust is not a strategy. Provable control is. Even a good employee benefits from a system that records their activity — because when something goes wrong, the log proves they were not at fault.

Pillar one: the principle of least privilege

The principle of least privilege has a simple rule: each employee should have access only to what they need to do their job — not one bit more.

A cashier needs to record transactions, not to see the exchange's overall profit and loss report.
A remittance clerk needs their own customers' files, not the partners' confidential accounts.
An accountant needs the reports, perhaps not the ability to change the live rate.

The problem with most software is that it grants access "all or nothing": either the user is an admin and sees everything, or the user is restricted and cannot get their work done. Real access control must be granular — down to the single-report and single-account level.

A practical example

Suppose you have an exchange with five employees. The ideal access table looks something like this:

Role	Record transaction	Approve transaction	See P&L	Change rate	Manage users
Cashier	Yes	No	No	No	No
Remittance clerk	Yes	No	No	No	No
Accountant	No	Yes	Yes	No	No
Operations manager	Yes	Yes	Yes	Yes	No
Senior manager	Yes	Yes	Yes	Yes	Yes

Note that no one in the first rows both records and approves. This is deliberate — which brings us to the second pillar.

Pillar two: segregation of duties

Segregation of duties is perhaps the most important principle of internal control: whoever performs an action must not approve that same action. The person who records and the person who approves must be two different people.

Why? Because when one person both records and approves, there is no control point. That person can create a fabricated transaction, approve it themselves, and no second eye ever sees it. Segregation of duties creates a mandatory second eye.

Classic examples of segregation of duties at an exchange:

Recording a remittance and approving the payment are two separate hands.
Recording a deposit and reconciling it against the bank statement are two separate roles.
Defining a new customer and assigning a credit limit are two separate decisions.

A subtle point: segregation of duties is impossible without granular access control. If you cannot give a user "the right to record" without giving them "the right to approve," segregation of duties is only a wish on paper, not a real control.

Pillar three: the activity log

The first two pillars prevent errors. The third pillar makes errors discoverable. The activity log means the system records who did what, and when.

Without a log, when a wrong document is found, all you have is an argument: "I didn't record it," "then who did?" With a log, the answer is a fact, not a claim. A good log has these traits:

Real-time: every action is recorded at that very moment, not with delay.
Comprehensive: recording, editing, deletion, login, rate change — all are recorded.
Immutable: the log itself must not be tamperable by ordinary users.
Searchable: you must be able to ask "who changed this document, and when?" and get an instant answer.

The activity log is not just a catch-them tool. Its preventive effect matters more: when everyone knows every action is recorded, the incentive to err drops sharply. One switched-on camera works better than ten warnings.

These three pillars in Nexto

A currency exchange accounting software that takes these three pillars seriously must both give granular access and log everything. In Nexto:

Permission down to the single-report and single-account level: you can decide exactly which report and which account each user sees — not "all or nothing." It is this granularity that carries segregation of duties from talk to practice.
Real-time log of every operation of every user: every record, edit, and deletion is logged with the user's name and time, live and reviewable.
Archive account: sensitive or old accounts can be hidden entirely so they fall out of the view of users who should not see them.

This combination means you can grant a new cashier access without worrying they will see the exchange's total profit or the partners' account, while at the same time knowing that whatever they did has been recorded.

Access control setup checklist

Before you add the next employee to the system:

Have you defined the roles? (cashier, remittance, accountant, manager…)
Have you determined the minimum access needed for each role?
Are recording and approving in two separate roles?
Is the activity log on and reviewable?
Are sensitive accounts hidden from the view of operational roles?

Every "no" on this list is an open control gap whose cost you will pay one day.

Conclusion

Employee access control stands on three pillars: least privilege (everyone only what they need), segregation of duties (recorder separate from approver), and the activity log (who did what, when). The first two pillars prevent errors, the third makes them discoverable. These are not distrust of employees; they are a structure that protects both the exchange and the good employee. And all of them depend on one technical prerequisite: a system that gives granular access and records everything.

To see how records and backup, alongside these controls, guarantee ownership of your data, read this article too: backup and data ownership.

Want to see how permissioning down to the single-report level and a real-time log work in practice? Build a dedicated demo and define a few different roles.