WEBSITE PLANNING

Plan Customer Portal Roles Before Building Screens

Turn vague portal roles into an explicit table of records, actions and approval rights.

Start with actions instead of impressive role names

Administrator, manager and customer can mean very different things across businesses. List concrete actions: view a project, upload a file, edit an address, approve a quote, invite a user and export records. Then identify which records each action applies to. View own project is a different permission from view every project.

Build a hypothetical role matrix

For an imaginary service portal, a customer can view their own project and submit requested information. Assigned staff can update that project’s progress. A billing role can manage invoices but does not automatically need every private attachment. An administrator can manage access, with sensitive actions reviewed. These are starting examples to discuss, not default permissions for every business.

Apply least privilege and review changes

OWASP recommends least privilege and consistent permission validation. Grant the access needed for a defined task and explicitly review exceptions. Joining a team, changing responsibilities and leaving the business should each trigger an access decision. Keep the approving owner and effective date so old permissions do not survive simply because nobody remembers why they were granted.

Test the matrix as a contract

Create one expected allow and one expected deny example for each sensitive action. Include attempts involving another customer’s record, direct file URLs and revoked access. Use controlled sample accounts and records. Test server-side enforcement rather than checking only which buttons appear. When new features arrive, update the matrix before release so an export or invitation feature does not accidentally expand access beyond the agreed roles.

Apply this to your website

Bring the relevant URL and a description of the decision to request a scoped website review. Do not send passwords or private customer records. The primary reference is the linked technical guidance.