Permission models fail at the edges rather than in the middle. The main case is usually right. What breaks is the situation nobody wrote down.
Here are the five we see most often, and what a correctly configured system does with each.
One. The partner who is on the deal for two weeks
A colleague is pulled in for a specific reason, sees the deal, gives a view, and moves on. In most systems they are added and never removed, because removal is nobody’s job.
Three years later, half the firm has access to a deal that closed. The fix is not vigilance. It is that access is granted through team membership with an owner responsible for the team, and that a periodic access review actually exists as a scheduled task rather than an intention.
Two. The deal that dies and comes back
A process ends. Eighteen months later the same company reappears through a different intermediary, possibly with a different deal team.
The historic record is valuable and it is also full of material the new team may not be entitled to see in the same way. The systems that handle this well keep the old record intact with its original access, and create a new record that links to it, rather than reopening the original and quietly widening the permissions.
Three. The operating partner who needs portfolio access but not pipeline
This one breaks because the natural instinct is to give people access by seniority. An operating partner is senior, therefore they see everything.
But their job is the portfolio, and pipeline access creates an MNPI exposure with no upside. Access should follow function rather than rank, which is easy to say and uncomfortable to implement, because it means telling a senior person they do not get something.
Four. The external adviser
Lawyers, accountants, and consultants need part of a deal record and nothing else. The common failure is either giving them a full licence and full access, or giving them nothing and emailing everything, which is worse.
The right answer is usually a scoped external access route, with only the records and fields they need, and an expiry. Building this properly takes a bit of work and it removes an entire category of accidental disclosure.
Five. The person who leaves
Somebody departs. Their account is disabled, which everybody remembers. What is often missed is that they owned records, and ownership is an access path.
Disabled accounts can still hold ownership, which means orphaned deals that no active person can see, or deals that transfer wholesale to a manager who should not have all of them. Offboarding needs a record reassignment step, defined before you need it rather than during the week somebody resigns.
The common thread
Every one of these is an exception rather than a rule. That is the point. A permission model designed only around the standard case will fail on all five, and it will fail quietly, which is the dangerous kind.
The practical test worth running: pick a closed deal from two years ago and ask the system who can see it today. If the answer surprises anyone in the room, the model needs work.
We cover the configuration behind all of this in the September 29 session, and there is a checklist version of these five scenarios available if that is more useful than an hour.