A new office worker should not begin with the owner’s login or a copy of the most powerful staff account. Send a separate invitation, give the worker only the access needed for the first supervised shift, and review what actually happened before adding anything else.
The practical starting point is a one-page access card: today’s tasks, the records needed for those tasks, the actions allowed, the actions held back, and the person who will review the account at the end of the shift. This turns a vague instruction such as “give them office access” into a decision the school can test.
Start with the first shift, not the final job description
A job description may say that an office administrator will eventually manage bookings, payments, messages, reports and staff records. That does not mean every one of those actions is needed on day one.
List the work the new person will perform while supervised. For example:
- find a student’s next lesson;
- confirm an instructor and pickup location;
- record a phone message on the correct student account;
- move an appointment within the school’s existing change policy; and
- check whether an invoice is due without changing the balance.
Then map each task to the smallest useful access. The Federal Trade Commission’s business guidance calls this the principle of least privilege: each employee should have access only to the resources needed for that person’s job. It also recommends knowing which employees can reach sensitive personal information and limiting that access to people with a need to know. Read the FTC’s data-security guide.
Use this first-shift access card
| First-shift task | Access that may be needed | Keep back unless the task requires it | Evidence to review |
|---|---|---|---|
| Answer “When is my lesson?” | View the relevant appointment and basic contact details | Deleting appointments, exports, settings | The worker found the correct student and gave the correct time |
| Confirm pickup details | View the appointment’s pickup location and assigned instructor | Changing service rules or instructor availability | The worker used the booking record, not a separate note |
| Record a phone message | Add an ordinary operational note or use the approved conversation channel | Bulk messaging, message-template changes, private staff notes | The message is attached to the correct student and is understandable |
| Move an eligible lesson | View available times and update an appointment, if the school permits supervised changes | Overrides, package edits, price changes | The original and new time can be explained and the student was notified |
| Check an amount due | View invoice or balance status | Refunds, credits, write-offs, payment-provider settings | The worker can state what is due without altering the ledger |
This is a starting example, not a universal role. Remove any row the person will not perform. If your software cannot separate “view” from “change,” or ordinary changes from financial overrides, leave the higher-risk task with the supervisor. Do not solve the limitation by sharing a more powerful login.
Send the invitation to one person and one account
Before sending a driving school staff invitation, confirm the employee’s email address or phone number directly. The invitation should create or connect one identifiable account for that worker. It should not lead to a shared “front desk” identity used by several people.
A separate account lets the school answer basic questions later: Who changed the appointment? Who opened the record? Which account needs different access? The FTC also advises businesses to tell employees not to share passwords and to consider multi-factor authentication. If the software supports multi-factor authentication, have the worker enroll their own method instead of using the owner’s device.
Prefer an invitation that expires and can be cancelled if it goes to the wrong destination. Ask the worker to claim it themselves. Never send an owner password in a text or write it on the front-desk computer.
Check three boundaries before using real student records
Sign in as the new worker, or have the worker share the screen while the supervisor watches. Check both what the account can do and what it cannot do.
- Record boundary: Can the worker reach only the students, instructors or locations needed for the shift?
- Action boundary: Can the worker perform the approved task without gaining refunds, exports, user management or configuration changes?
- Attribution boundary: When the worker makes a permitted change, does the school have enough history or context to identify the account and explain the change?
Use demonstration records for the first pass. Give the worker a fictional student, a sample appointment and an invented balance clearly marked as examples. Ask them to find the lesson, record a message and attempt one action that should be blocked. That last test matters: seeing the permitted screen does not prove the restricted action is unavailable.
RouteOS sells driving-school software, so this guide has a commercial interest. Its current mobile workspace description says available actions depend on account permissions and school settings. That is a reason to verify the exact school configuration during a walkthrough, not a promise that every account already has the boundaries in this worksheet.
A worked first-shift decision
Suppose Nia is covering phones and the front desk from 9 a.m. to 1 p.m. The owner wants her to answer schedule questions, confirm pickup information and record messages. She will watch the owner handle rescheduling and payments before doing either herself.
| Decision | First-shift choice | Reason |
|---|---|---|
| Account | Nia receives her own invitation | Her work stays attributable; no shared password |
| Schedule | View today and tomorrow for the office’s location | Enough to answer calls without opening unrelated branches |
| Student records | View basic contact and pickup details needed for the call | Supports the task without a full student export |
| Messages | Add an ordinary message using the approved workflow | Keeps the call connected to the student record |
| Appointments | View only on the first shift | Nia observes the change policy before receiving edit access |
| Financial actions | View an amount due; no refunds, credits or price changes | Those actions need separate instruction and review |
| Administration | No staff invitations, roles, exports, integrations or school settings | None is part of the first-shift work |
At 1 p.m., the owner checks the calls Nia handled. If she consistently found the right records and recorded clear messages, the next shift might add appointment changes within the documented policy. If she needed an export only because the normal search was confusing, the better fix may be improving the search workflow—not granting export access.
Review evidence, then expand one decision at a time
End the first shift with four questions:
- Which assigned task could the worker not complete?
- Was the problem missing access, missing training or a broken workflow?
- Did the account expose anything unrelated to the assigned tasks?
- What single permission, if any, should change before the next shift?
Record the decision and the next review date. “Keep the same access” is a valid result. Time employed is not evidence that a person needs refunds, exports or user-management rights.
If you are adding more than one team member, use the broader controls that become necessary as a driving-school team grows. If the new person is an instructor, the access check belongs inside a larger set of instructor onboarding gates before the first solo lesson.
The goal is not to make the first shift artificially difficult. It is to give the worker enough access to succeed while keeping the next permission decision small, visible and reversible.