Nobody decides to hand out admin access. It drifts.

TL;DR: A team connected a calendar app for two users, hit "insufficient privileges", and made both users system administrators because that was the one thing that worked. It always is — admin access fixes every permission error, which is exactly why it spreads. The real fix was a specific permission set and took ten minutes. If you don't know how many admins your org has today, that's the audit to run this week.

In a session this week, a client walked me through a job he'd finished while I was away. Two team members needed a calendar app in Salesforce connected up to Slack — genuinely useful, the kind of thing that saves people chasing each other all day. He connected it, and the app came back with "insufficient privileges". So he did the one thing that reliably works: he made both users system administrators. Problem solved.

To his credit, he'd flagged it himself as something to put right.

The conventional view

Access is treated as plumbing. If something says you don't have permission and the deadline is today, you grant whatever makes the error go away and get on with your job. If it works, nobody revisits it. In a busy team, that's not laziness — it's a perfectly rational response to friction.

The challenge

A system administrator account isn't a bigger user account. It's the ability to change anything: delete the field a forecast report depends on, edit the automation that routes your leads, export the entire database. The risk isn't that your people are untrustworthy; it's blast radius. The more hands that can change anything, the more ways an ordinary Tuesday can quietly break something everyone relies on.

And it compounds. The next time a connected app complains, the precedent exists: admin worked last time. Salespeople don't hate Salesforce, they hate friction, and when the proper route is less obvious than the fast one, the fast one wins every time. That's how access drifts: no decision, no meeting, just one workaround at a time until nobody can say exactly who can do what, or why. The same session surfaced the quieter version of the problem — a user who had left the business, account still sitting there — because leavers' access also belongs to nobody until someone owns the question.

The strategic truth

Here's the thing: the correct fix was smaller than the workaround. The app shipped with its own permission sets. We assigned the right one to both users, took system administrator away, and everything carried on working, confirmed on a two-minute phone call. Ten minutes, done properly, instead of a standing risk nobody remembers creating.

That's the pattern worth internalising. "Insufficient privileges" is not a request for more power; it's a question: which specific permission is missing? The answer is nearly always a permission set that grants precisely what's needed and nothing more. Admin access answers the question with a sledgehammer, and the cost is invisible until the day it isn't.

Why this matters to your business

Every extra admin chips away at the thing you actually bought Salesforce for: records you can rely on. Trusted reporting assumes the fields, automation and data underneath it stay put, and a well-meaning admin tidying things up on a Friday afternoon is statistically more dangerous to that than any outside threat. There's a confidence cost too: the first time a report breaks because something was changed and nobody knows by whom, people stop trusting the system and start keeping their own spreadsheets. That's drift with a direct commercial price.

Access sprawl is also a reliable symptom of a wider condition: a system nobody clearly owns. The workaround lives forever precisely because no one's job is to go back and do it properly.

What to do about it

This is a genuinely quick audit, and it's worth doing this week:

• List every user with the System Administrator profile. The number usually surprises people.
• Write the reason next to each name. "Needed it for an app once" is not a reason; it's a permission set waiting to be assigned.
• Check for leavers. Any active account belonging to someone who's left the business gets dealt with today, not at the next tidy-up.
• Change the house rule: "insufficient privileges" triggers a question about which permission is missing, never an upgrade to admin.

Then put a quarterly repeat in the diary, because access doesn't stay fixed; it drifts back the same way it drifted out.

Audit while it's calm

The day someone got admin "just for now" is never the day it bites. The businesses that stay out of trouble aren't the ones with perfect users — they're the ones that look at who-can-do-what while everything is still boring.

If you're not sure who can change what in your org — or the list of admins has grown and nobody quite remembers why — start with an honest picture of where the system really stands. The Salesforce Reset is 60 minutes and £2,500, with written findings covering exactly this kind of quiet risk. Book a Reset.