In this guide 6 sections
Give each role only what it needs. A sub-agent sees their own clients, a cashier sees premium receipts but not claims, and a relationship manager sees the full family. The principal alone sees everything, runs reports and holds the export button, which is why that login stays off the shared counter screen.
Why a shared login is the first mistake
Many agencies start with one shared username. It works fine. Then a sub-agent resigns, walks out with a spreadsheet of every policyholder he ever served, and the principal learns that nothing recorded who exported which list.
Shared logins also hide who changed what. When a premium amount is edited or a nominee replaced, nobody can say who did it, on which day, or from which counter. Nobody owns the mistake.
Separate logins cost nothing. They give you an audit trail, let you switch off one person on their last day, and show an insurer that proposal forms and KYC copies were guarded.
What each role needs to see
Start from the work. Ask what each person opens first thing in the morning, then grant exactly those fields and nothing beyond them, whatever their title or years of service.
A sub-agent needs the names, phone numbers and policy numbers of their own clients, but never the agency’s commission rates with insurers or client lists of other sub-agents.
A cashier needs receipts and bank references. Medical declarations on a health proposal are none of their business, and neither is the commission a sub-agent earns on a renewal.
- Sub-agent: own clients, own policies, own commission statement
- Cashier: premium due, receipt entry, bank reference
- Relationship manager: full household, renewals, claim status
- Back-office executive: policy schedules, endorsements, documents
- Principal: all records, reports, user setup and exports
Sensitive fields that need a lock
Some data deserves extra care. Health declarations, nominee details, identity documents and bank account numbers are the usual four, and each should sit behind its own permission instead of the general one.
A relationship manager can read a claim’s status without opening the diagnosis on the hospital discharge summary, and a cashier can match a receipt without seeing the nominee’s address.
Document folders matter as much as screens. A scanned passport page sitting in a shared drive defeats every rule you set inside the software, because anyone with the folder link can open it.
Controls that stop the quiet leaks
The biggest risk is rarely a hacker. It is a trusted employee with a legitimate login, a USB stick and an afternoon alone at the counter after everyone else has gone for lunch.
Only the principal may export. Log every client list print. Limit sub-agents who work from home to approved laptops and office hours, so a stolen password alone opens nothing and a lost laptop exposes no files.
Review the user list every quarter. Remove anyone who has left, and downgrade anyone whose duties changed, so old permissions never pile up behind a promotion or a transfer to another branch.
- Export and download limited to the principal
- Log of who opened which client and when
- Login blocked on the day a person is deactivated
- Quarterly review of active users and their roles
Introducing roles without annoying the team
Explain the reason plainly. Nobody is being distrusted. Restrictions protect policyholders’ health information, and they also shield staff from blame when a record goes missing or a premium figure is changed.
Pilot with one sub-agent and one cashier. Ask both what they needed to do but could not, adjust the matrix, and switch every user over on one announced date.
Role and access matrix
Roles run down one printed page, from sub-agent and cashier to relationship manager, back-office executive and principal, with columns for client contact, schedule, receipts, claims, health declarations and export. Mark each cell view, edit or none. No login before the principal signs.
Open a blank worksheet to printQuestions owners ask
Can a sub-agent see clients who came through another sub-agent?
Normally not. Each sub-agent sees their own book. If two sub-agents share one household, the relationship manager can see both books and coordinate the renewals, so neither agent quotes over the other.
Who should hold the admin login?
The principal, or one trusted senior. Keep that login away from daily work, and sign it out at lunch, so it never sits open on a shared counter screen.
What happens when a sub-agent leaves?
Deactivate the login that day. Reassign the clients to another agent, and the history stays on file, so renewals, endorsements and premium reminders carry on without a gap.
Does this satisfy the insurer’s data rules?
Insurers and regulators set their own requirements. Role-based access supports those requirements, but only your insurer agreements and local law can tell you what is mandatory for your agency.