Answer:
Good question - access control must be carefully audited, before and after implementation. You don't want to give someone too much access if their job or position does not require it, and too little for others so that they can't do their job appropriately.