5.5 Access control matrix + audit trails

Security in a manufacturing environment requires vigilance to prevent both external threats and internal, accidental data corruption (such as an operator unintentionally modifying a Master Routing). The principle of Least Privilege provides a strong defense. A user should be granted exactly enough access to perform their specific job function, and no more.

The RBAC standard (role-based access control)

It is highly recommended to assign permissions to Roles rather than to individuals. When a team member changes jobs, you update their Role, leaving individual settings manageable and auditable.

Standard factory personas

1. Operator:
   • Primary Interface: The Station HMI.
   • Rights: Log in, Start/Stop Cycle, Acknowledge Alarm.
   • Block: No access to the underlying Windows OS desktop, network settings, or recipe parameters.
2. Line Lead / Maintenance:
   • Scope: The Line.
   • Rights: Override Interlocks (with a logged code), Adjust Mechanical Offsets, Clear Jams.
   • Block: Cannot change Master Data (BOM or Route).
3. Process Engineer:
   • Scope: The Process.
   • Rights: Edit Recipes (in Draft mode), Analyze Data, Change Cycle Times.
   • Block: Cannot “Release” their own changes (this requires a Quality signature).
4. Quality Manager:
   • Scope: Compliance.
   • Rights: Approve/Reject Recipes, Release Master Data, Disposition Non-Conformances (e.g. Scrap).
   • Block: Cannot Edit Machine Parameters.
5. IT Admin:
   • Scope: Infrastructure.
   • Rights: Manage Users, Execute Backups, Apply Patches.
   • Block: Avoid granting IT Admins “Super User” access to Business Data. An IT Admin should not have the system capability to “Pass” a failed unit.
6. Auditor:
   • Scope: Oversight.
   • Rights: Global Read-Only access.
   • Block: Zero Write access.

The matrix

Action	Operator	Maint / Lead	Engineer	Quality	IT Admin
Execute Order	✅	✅	✅	❌	❌
Edit Recipe	❌	❌	✅ (Draft)	❌	❌
Approve Recipe	❌	❌	❌	✅	❌
Bypass Interlock	❌	✅ (Log)	✅ (Log)	❌	❌
Scrap Unit	❌	❌	❌	✅	❌
User Mgmt	❌	❌	❌	❌	✅
View Reports	✅ (Own)	✅	✅	✅	❌

The JML lifecycle (joiner, mover, leaver)

User access tends to accumulate unneeded permissions over time. “Privilege Creep” occurs when a user moves departments and retains their old access rights while acquiring new ones. A strict lifecycle must be enforced to mitigate this.

Joiner (new hire)

• Trigger: HR System or Helpdesk Ticket.
• Rule: An established Profile must be copied. (e.g. “Mirror permissions of a standard Operator”).
• Validation: The relevant Manager must approve the specific Role request.
• SLA: Ensure access is ready on Day 1.

Mover (job change)

• Trigger: Promotion or Department Transfer.
• Risk: Accumulation of conflicting rights (e.g. an Operator becomes an Engineer but retains the ability to execute production operations).
• Logic:
  • Step 1: Revoke ALL current permissions.
  • Step 2: Apply the NEW Role permissions entirely.
  • Pro-Tip: Avoid simply “Adding” the new role on top of the old one.

Leaver (termination)

• Trigger: HR Notification.
• Action: An Immediate Account Disable must be executed (both in Active Directory & MES).
• Speed: Complete within < 1 Hour from the termination notice.
• Clean Up: Ownership of any “Checked Out” files or records must be transferred to the responsible Manager.

Audit trails: the “god view”

Every click that alters data must be recorded. If the system cannot reliably reconstruct who changed a setting and when, it may not be fully compliant.

The Four Key Log Elements

For every INSERT, UPDATE, or DELETE operation, the system should log:

1. Who: The specific User ID (avoid generic “Admin” accounts).
2. When: A UTC Timestamp.
3. What: The specific Field that was changed.
4. Value: Both the Old Value and the New Value.

Engineering Practice

Audit logs must be Read-Only. Even the IT Admin should not have permissions to delete the Audit Log. Ship these logs to an immutable SIEM (Security Information and Event Management) system or WORM storage.

The access review (cadence)

Access should not be set and forgotten; permissions naturally drift over time and must be regularly reviewed.

• Frequency: Quarterly (Every 90 Days).
• Process:
  1. IT generates a report of all Active Users and their assigned Roles.
  2. Department Managers receive the list relevant to their team.
  3. Action: The Manager must actively mark each user as “Retain” or “Revoke.”
  4. Logic: When a Manager fails to review the list by the Deadline, the system should ideally Auto-Disable the unverified accounts to enforce compliance.

---

Recap: Role-Based Access Control and Audit Trail Implementation

Role	Key Permissions	Critical Blocks	JML Action
Operator	Execute Order, View Own Reports	No Desktop/Network/Recipe Access	Joiner: Mirror standard profile.
Line Lead / Maintenance	Bypass Interlock (Logged), Adjust Offsets	No Master Data (BOM/Route) Change	Mover: Revoke ALL, then apply NEW role.
Process Engineer	Edit Recipe (Draft), Change Cycle Times	Cannot Release own changes	Leaver: Disable account within <1 hour.
Quality Manager	Approve/Release Recipe, Scrap Unit	Cannot Edit Machine Parameters	Access Review: Quarterly (90 days).
IT Admin	Manage Users, Execute Backups	No “Super User” on Business Data	Audit Logs: Read-Only, immutable storage.
Auditor	Global Read-Only Access	Zero Write Access	Logging: Who, When, What, Old/New Value.