User Permissions and Audit Trail in Contractor Systems

User permissions and audit trail rules decide who can open each screen, what they can do there and which branches and districts they see — and let you trace important changes to a person and a time. In a system that runs utility work orders, they are what separates a controlled operation from a shared spreadsheet.

This guide for operations managers at electrical contractors covers the permission matrix, data scoping, audit trail design and how ELX applies each. The principles come from the NCA’s Essential Cybersecurity Controls, used here as good practice — not as a compliance claim.

Why do fine-grained permissions matter for electricity contractors?

One work order passes through many hands: the work-order team, then survey, permits and execution, then quality, the achievement certificate, drawing and extracts — with storekeepers recording materials alongside. Each team enters some data and only reads the rest.

Some of it carries financial weight — certificate quantities and prices, extract fines, stock issues and returns. When access is broader than the job, familiar problems follow:

• Someone edits a quantity or price outside their role, unnoticed.
• A supervisor browses another branch’s orders and subscriber details with no business need.
• An order changes stage or disappears, and nobody knows who did it or why.
• Disputes are settled by opinion rather than evidence.

The identity and access management controls in the NCA’s ECC-2:2024 call for access based on need-to-know and need-to-use, least privilege and segregation of duties, with periodic review of identities and access rights. They also require multi-factor authentication for remote access and privileged accounts — an authentication topic outside this guide, which focuses on authorisation and the audit trail.

What is the difference between screen access and action rights?

Screen access answers one question: can this user open the screen at all? Action rights decide what they do inside it. A quality inspector may need to see excavations and items without changing them, so rights are granted one action at a time, not as a simple “in or out”.

The model used in this guide — the same one ELX uses — splits each screen’s rights into eight actions:

Show

Open the screen and read its records within the user’s scope.

Add

Create a record, such as a work order or stock document.

Update

Change an existing record; on distribution screens, assign an order to a user.

Delete

Remove a record — ideally as a soft delete that stays traceable.

Change status

Change a record’s status — for example, activating or deactivating an entry in the guides (master data).

Show others’ data

Open records assigned to other users — a supervisory right.

Relay

Move a work order to its next stage — a decision, not data entry.

Import

Load many records at once from Excel — best kept to a named few.

Separating relay from update lets a clerk complete a stage while a checker decides when the order moves on. Restricting import reduces the risk of one faulty spreadsheet turning into hundreds of faulty records.

How do you limit each user’s data to their branch and district?

Permissions define what a user can do; scope defines which records they can do it to. In a multi-branch contractor system, each user is linked to their branches, cities and districts, so their lists and dashboard show only that scope, while the administrator sees everything.

Administrative offices help organise work inside that scope: each covers a set of districts (region, city, district), and every work order is tagged with its office, so orders can be filtered and followed up office by office.

Inside the scope sits a third layer, record ownership: only the assignee — or a user holding “show others’ data” — can open an order. Two technicians in one district can then work side by side without seeing or editing each other’s orders.

What should an audit trail record?

A useful audit trail answers four questions about any important record: who changed it, what they did, when, and what it looked like then. Without the fourth, a list of names and timestamps settles nothing.

• The user who performed the action.
• The action type: add, edit, delete or status change.
• The table or module, and the record affected.
• Date and time.
• A snapshot of the record’s values at the time.
• Full change history per record, on demand.
• A mandatory note for exceptions such as a manual stage change.

Keep two kinds of log apart. The audit log in your work-order system shows who changed a work order or a master-data record; cybersecurity event logs cover the technical estate. The ECC requires event logs to be activated for critical information assets, privileged accounts and remote-access events, monitored continuously and retained for at least 12 months. The two complement each other; neither replaces the other.

Soft deletion completes the picture: a deleted record leaves daily lists but stays traceable, with who deleted it and when. A hard delete erases the evidence an auditor asks for first.

How do you document stage changes and reassignments?

Normally an order moves through the utility work order stages by relay once its data is complete. Exceptions happen — an order relayed by mistake, a leaver with orders still in their name, a workload spike — and they are what most needs documenting.

1. Limit who holds the right

   Give stage-change and reassignment rights to named supervisors only.

2. Require a written reason

   Make the change note mandatory, so no move is saved without a reason.

3. Pick authorised handlers

   The new handler should come from district users permitted on that stage’s screen.

4. Store old and new values

   Record the previous and new stage, the note and the date, so the order’s path can be rebuilt.

5. Review changes on a schedule

   Review manual changes weekly or monthly; a cluster in one branch usually points to the process before the people.

Reassignment needs its own supervisor screen: it shows who holds each order in every basket and since when, and lets the supervisor move the order to another user or remove the assignment, so ownership is always clear.

What does a suggested permission model by role look like?

This starting point uses the eight actions above and the roles common in electrical contracting. Adapt it to your team: where one person covers two roles, the audit trail matters even more.

The common thread is segregation of duties: whoever records execution does not grade its quality, whoever prepares the extract does not change certificate quantities without an explicit right, and whoever enters a stock document does not delete it. Where team size rules that out, the audit trail and regular reviews compensate.

How does ELX apply user permissions and audit trail controls?

ELX is a bilingual (Arabic/English) cloud (SaaS) service hosted and operated by Matrix. It runs in the browser with no servers needed on the contractor’s side, and it is built for electricity-network contractors in Saudi Arabia to carry each utility work order from registration to archive. Its governance rests on a permission matrix, data scoping and traceable logs.

In the permissions and settings module, an administrator sets each user’s rights per screen from one matrix: show, add, update, delete, change status, show others’ data, relay and Excel import — per action, per screen or across all screens. Users without a right land on an unauthorised page, and the side menu lists only permitted screens.

• Scope: users are linked to branches, cities and districts, so their lists and dashboard stay in scope; administrators see all.
• Ownership: users claim an order with the “Open” button before working on it; from then on, only the assignee — or a holder of “show others’ data” — can open it.
• Controlled relay: “Relay” checks the relay right and the stage’s mandatory fields, notes and attachments first. On distribution screens, viewing and assigning are separate rights.
• Audit log: adds, edits, deletes and status changes in master data (guides) and in operational modules such as work orders, projects and order distribution are logged in the background with table, action, user, date and a record snapshot; administrators browse the log and open any record’s full history.
• Manual stage change: in work order management, an authorised user moves an order to any stage up to drawing, picks the new handler from permitted district users and must add a note; each change is logged separately with old and new values.
• Re-assignment: a supervisor screen moves assigned orders to another active user or removes the assignment.
• Soft delete: work orders, stock documents and material estimates are soft-deleted and stay traceable; work-order deletion runs from a screen with its own permission and asks for confirmation before linked stock orders are deleted with it.
• Company data isolation: each company runs its own web instance, with a separate database per company; our security and data governance page sums up all of these controls.

Screens and permissions can be renamed in Arabic and English to match your team’s terms, and where you need more than new labels, Matrix customises screens, reports and stages to each contractor’s needs. The logging has clear limits: the audit log covers master data and key operational records, not every click. For the wider buying picture, see our guide to electrical contractor software in Saudi Arabia.

What are the most common permission-management mistakes?

• Shared accounts: one login per team strips the audit trail of meaning, because a user name no longer points to a person.
• Granting “all screens” to get started: temporary access tends to stay. Start with the minimum.
• Handing out “show others’ data”: giving this supervisory right to all removes the ownership layer.
• Keeping leavers’ accounts: reassign their orders, then withdraw their rights and close the account the day they leave.
• No periodic review: roles change, and permissions do not follow on their own.
• Confusing the two logs: the system audit log does not replace IT’s event logs.
• Hard deletes: once records can be wiped for good, the trail is gone.

Permissions also touch personal data: a work order carries the subscriber’s name, mobile number and address. See our guide to personal data protection for contractors.

To see the permission matrix and audit log in ELX mapped to your team’s roles, request a demo.