Stricter Access Control—Why Shared Shop-Floor Accounts Still Appear

Why stricter access control still leads to shared shop-floor accounts

After the system went live, the factory required each person to use their own account. A few weeks later, the night shift put the team leader's account on the equipment to avoid production downtime: new staff lacked permissions, temporary replacements couldn't apply in time, and approvers couldn't be found after hours.

Management sees violations of shared passwords, but on the shop floor, the reality is that tasks must be completed and authorization fails to keep up with changing roles. Emphasizing 'not allowed' makes shared accounts the default path.

The issue goes beyond cybersecurity. Parameter changes, material release, and abnormal shutdowns all appear under the same name, making it impossible for even complete logs to explain who made the judgment and on what basis.

Shared accounts erase both responsibility and help signals

The NIST semiconductor manufacturing framework acknowledges that shared accounts exist within the industry and recommends assigning unique credentials to users, equipment, and processes, and integrating authentication, authorization, and logging as much as possible.

The FDA data integrity guideline states that shared logins cannot identify specific individuals; actions such as modifying records or parameters should be attributed to specific personnel. Read-only shared accounts cannot replace review actions that require personal accountability.

Using high-permission accounts by multiple people results in the loss of two types of information: who actually performed the action, and which roles frequently borrow accounts due to insufficient permissions. The latter is a signal that the process needs adjustment.

Strict access control does not guarantee minimal business risk

Operators want to quickly resume production, team leaders are responsible for delivery, IT departments fear loss of control over permissions, and quality departments require traceability of critical actions. All four objectives are reasonable, yet they may leave the cost of waiting to the night shift.

Medium-sized growing factories are especially prone to situations where positions are already divided, replacements are frequent, and authorization responses still rely on manual processes during the day. The most practical self-protection for employees is to use an account that can complete the task first, then explain anomalies as verbal authorization.

The more detailed the permission matrix in mature factories, the harder it is to assign temporary responsibilities. Without emergency applications, time-limited authorization, and automatic expiration, operations will still shift to offline processes.

Replace 'personal account' with four practical mechanisms

First, establish basic permissions based on job roles. New employees, replacements, and cross-shift support automatically receive the minimum necessary permissions upon entering a role and have them immediately revoked upon leaving.

Second, provide time-limited authorization for urgent tasks. Clearly define the applicant, approver, business justification, allowed actions, and expiration time; when the approver is unavailable, there should be a clear escalation path.

Third, bind critical actions to personal confirmation. Even if high-risk parameters, release, or closure actions are completed on shared terminals, they must be confirmed by the specific executor through means such as an ID card, short code, or other methods.

Step four involves weekly checks of borrowed account signals. Password papers near equipment, continuous operations with the same account across shifts, and abnormal times not matching the schedule should trigger a process review. Issues should not be immediately attributed to employee attitude.

NIST SP 800-171 emphasizes unique user identification and retains user, time, and event results in audit logs. Logs that can trace to specific individuals hold investigative value.

What factory owners really want is faster authorization response

While prohibiting shared passwords remains necessary, it should not be the sole indicator. Factory owners should also monitor how long it takes to activate new employee accounts, how quickly emergency authorizations are granted for night shifts, whether temporary permissions are timely revoked, and which roles most frequently borrow accounts.

Permission anomalies must be reported, transferred, handled, escalated, and closed. If the information department only handles rejections and production only handles follow-ups, team leaders will fear being blamed for overwork, ultimately resorting to borrowing accounts to protect themselves.

Small factories should first remove high-permission passwords from equipment areas; growing factories should integrate scheduling with permissions; mature factories should implement unified identity management. Not all factories need to implement all tools at once, but the personal accountability chain must remain intact.

Factory owners can forward the inspection checklist to plant managers, workshop supervisors, and team leaders to verify borrowing numbers, waiting, and expired recycling records within a week, then decide whether to prioritize permission improvements or duty mechanisms first.

Effective access control ensures that the right people perform the right actions, making every exception visible, traceable, and time-bound. Simply locking the door does not prevent keys from being copied secretly.

I am Huang Chaoxing, the inventor of the TreeMES stack-light MES system. Follow me for ongoing analysis of shop-floor management and digital transformation trends in manufacturing.