Good user permissions in CNC software come down to one rule: every person gets the access their job needs, under their own login, and nothing more. Operators can see jobs, run tools and log what happened. Programmers and engineers can change cutting parameters and files. Owners and managers see costs, users and history. Everything is logged, so you can answer "who changed this, and when?" in seconds.
This guide shows how to design those roles for a real shop, what to look for in software, and the mistakes that cause scrap and lost production.
TL;DR
- Assign permissions by role (operator, programmer, manager, owner), not person by person. Role-based access control makes onboarding and role changes faster and keeps stale permissions from piling up.
- Apply least privilege: operators should view and log, not edit master cutting parameters or shop-wide data.
- Insist on individual logins and an audit trail. Shared logins make accountability impossible.
- Keep one documented emergency account, and review access every quarter.
- Our platform includes role-based access, audit logs and team collaboration, so one cloud app can cover calculators and shop management.
Table of Contents
- Why permissions matter on a shop floor
- The model: role-based access, least privilege
- A starting permission matrix for a CNC shop
- Individual logins and audit trails
- The emergency access problem
- Preventing permission creep
- What to look for in CNC software
- Our perspective
- How Availzye Machinist Pro handles a team
- A worked example: a six-person job shop
- Common mistakes
- FAQ
- Sources
Why permissions matter on a shop floor
Most shops start informally. One shared computer, one spreadsheet of speeds and feeds, a folder of programs everyone can open. It works until it doesn't: someone "fixes" a spindle speed in the master sheet, the next job runs on the changed number, and nobody knows who touched it.
Permissions are mostly about operations, not paranoia. Guidance from Cisco on role-based access in manufacturing frames it this way: let operators monitor production data while restricting their ability to edit cutting parameters, and you cut accidental scrap and downtime without slowing the team down.
There is a security side too. A German machine tool industry guide on IT security in machine tools notes that production equipment often has no individual authorizations or passwords at all, so the standard user effectively has admin rights. Cloud software lets you fix that for the data side of the shop, even if some older machines stay as they are.
The model: role-based access, least privilege
Roles, not individuals
In role-based access control (RBAC), permissions attach to a job function such as operator, engineer or quality manager. People inherit what the role allows. According to Symestic's RBAC overview, this structure lets administrators manage groups instead of individuals, which makes onboarding and role changes much quicker.
For a five-person shop it feels like overkill until you hire your sixth person, or your best programmer moves to the front office. Changing one role assignment beats hunting through a dozen settings.
Least privilege
The principle of least privilege says a user gets the minimum access needed for their tasks. CISA's Secure by Demand guidance for OT owners and operators names role-based access control as a baseline control and tells buyers to look for it when selecting digital products. The same document is useful as a purchasing checklist: ask vendors about authentication and access control before you sign.
In practice, least privilege does not mean locking people out of what they need. An operator still has to stop a cycle, note a problem and check a tool's life. The goal is to block the edits that can wreck a job, not the actions that keep one running.
A starting permission matrix for a CNC shop
The table below is a practical starting point, not a standard. Adjust it to your shop's size and customers.
| Area | Operator | Programmer / engineer | Manager | Owner / admin |
|---|---|---|---|---|
| View jobs and work orders | Yes | Yes | Yes | Yes |
| Update job status, add shift notes | Yes | Yes | Yes | Yes |
| Edit master cutting parameters and reference data | No | Yes | Yes | Yes |
| Check tools in and out, log tool life | Yes | Yes | Yes | Yes |
| Write off tools, change stock thresholds | No | Limited | Yes | Yes |
| Upload or replace CAD files and documents | No | Yes | Yes | Yes |
| View cost estimates and quoting data | No | Limited | Yes | Yes |
| Log maintenance and downtime | Yes | Yes | Yes | Yes |
| Add or remove users, change roles | No | No | Limited | Yes |
| View audit logs | No | No | Yes | Yes |
"Limited" means decide deliberately: for example, a programmer may see cost data for jobs they programmed but not shop-wide margins.
Three rules for the matrix
- Separate viewing from editing. Most of the shop needs to read parameters and drawings. Few people need to change them.
- Protect the sources of truth. Master feeds and speeds, tool libraries, approved setup sheets and released CAD files are the things that spread errors to every later job.
- Keep money data on a need-to-know basis. Hourly rates, margins and customer pricing belong with managers and owners.
The Manufacturing Security guide from EMS Handbook makes the same point: the risk is not only outside threats but also internal, accidental data corruption, such as an operator unintentionally changing a master routing.
Individual logins and audit trails
A permission system is only as good as the login behind it. If three operators share one "shop" account, you cannot tell who changed a tool offset note or deleted a document. The VDW security guide recommends replacing default passwords with unique credentials and not sharing them across the team, because accountability for changes is impossible with shared logins.
An audit trail records who made a change, what changed and when. CISA's Secure by Demand guidance points shops toward products that support multi-factor authentication and role-based access out of the box. If you work under ISO 9001, access is part of document control: ISO 9001 clause 7.5.3 explained by an auditor training provider notes that access can mean permission to view only, or permission to view and change. That is exactly the distinction your roles should encode. Check your own quality manual and your registrar for what your audits require. We do not claim any software makes a shop compliant by itself.
The emergency access problem
Shops hit a real tension. Lock down critical files too hard and a Saturday rush job stalls because the one person with edit rights is unreachable. Hand everyone administrator rights and you are back to the shared-login problem.
CISA's guide on adapting zero trust principles to operational technology covers privileged access management: limiting changes to an environment to those with privileged access. A workable shop version is a "break-glass" routine:
- One highly privileged account, with a strong unique password, kept secure (a sealed envelope in the office safe works for a small shop).
- A written rule for when it may be used, such as the owner being unreachable during a customer-critical run.
- A note in the job record after every use, plus a review at the next management meeting.
The audit log is what makes this safe: the emergency account can be used, and every action it takes is visible afterward.
Preventing permission creep
Permissions rarely get revoked on their own. A machinist who covered the front office three years ago still has quote access. A former employee's account is still active. Practitioners writing about this problem, including the EMS Handbook source above, describe it as permission creep and recommend regular reviews.
A quarterly review takes about 20 minutes in a small shop:
- Export or list every active user and their role.
- Remove anyone who has left, including seasonal and contract staff.
- Ask each manager whether each person's role still matches their job.
- Check the audit log for edits to master data, and confirm each one was expected.
- Test the emergency account and write down the date.
What to look for in CNC software
When comparing options, whether a CAM package, a shop management tool or a calculator suite, ask these questions before you look at features:
- Does it support roles with different edit and view rights? Or is it just one admin and everyone else?
- Is every user a named account? Avoid anything that depends on a shared login.
- Is there an audit log you can read without a vendor ticket?
- Can you restrict who can generate output files? CAM and woodworking platforms such as Mozaik, for example, let administrators control who can produce machine files. For a shop, that is the control that matters most for programs that reach a spindle.
- Where does the data live, and who backs it up? Cloud tools give one current copy instead of five spreadsheets with different numbers. Our own notes on cloud CNC benefits on the shop floor go deeper on this.
- How does it treat AI-generated output? Permissions should decide who may approve a program, not just who may create one. See our guide on verifying AI-generated G-code before it touches the spindle.
The AI point connects to a broader finding. A peer-reviewed study in MDPI Computers found that AI coding assistants can speed work up but risk suboptimal code without oversight from a skilled human. A role system that reserves release rights for experienced people is how you put that oversight into practice.
Our perspective
We built Availzye Machinist Pro for machinists and shop owners who were stitching together spreadsheets, paper logs and separate calculator apps. Permissions are where that patchwork hurts most, because a spreadsheet has no idea who you are.
Our view is simple. Calculation tools and shop records belong in one cloud-synced app, so the person running a Feeds & Speeds calculation, the person logging tool life and the person reading the job tracker are all working from the same data. Once the data is shared, access has to be deliberate: the platform offers role-based access, audit logs and team collaboration so owners can decide who edits and who only sees.
We also think permissions should be boring. Set the roles once, review them quarterly, and spend your time on cutting parameters and customers instead of arguing about who changed a cell.
— Availzye
How Availzye Machinist Pro handles a team
The platform combines cutting calculators (Feeds & Speeds, Tool Deflection, Power & Torque, Chip Thinning, Chatter Prediction, G-code analysis) with shop management: a Job Tracker for work orders, a Maintenance Tracker for downtime and service logs, Tool Crib inventory with low-stock alerts and tool life logging, CAD file viewing, document management and shift notes. Team collaboration comes with role-based access and audit logs.
Plans are Individual at 9.99 CAD per month, Small Shop at 24.99 CAD per month and Team at 49.99 CAD per month, each with a 7-day free trial. You can see the plans on the Availzye Machinist Pro home page and try your own role setup during the trial before committing.
A worked example: a six-person job shop
Consider a hypothetical shop with an owner, a manager, one programmer and three operators. This is an illustration, not a client case.
- Owner: admin role. Adds and removes users, reviews the audit log monthly, holds the emergency credentials.
- Manager: full access to jobs, costs and maintenance. Cannot change user roles.
- Programmer: edits parameters, G-code and CAD documents. Sees job costs only for the jobs they program.
- Operators: view jobs and drawings, log tool life and shift notes, record downtime. No edits to master parameters, no write-offs.
A new operator arrives on Monday: assign the operator role and they are productive that day. A programmer leaves on Friday: remove the account that afternoon, and their history stays in the log. A quarterly review then catches the one operator who had been given edit rights for a project and never lost them.
Notice what the operators keep. They can still log a worn tool, flag a maintenance issue or note that an offset drifted. Our checklist on CNC maintenance intervals works best when the people closest to the machine can write into the log freely.
Common mistakes
- Starting with everyone as admin "for now." It rarely gets tightened later. Start restrictive and open up on request.
- Creating roles named after people. "Dave's access" cannot be reused or audited.
- Ignoring departed staff. Offboarding is part of access control.
- Locking out the people who log problems. Operators who cannot record issues stop recording them, and you lose the data that prevents repeat scrap.
- Treating the audit log as decoration. Read it after any unexplained job problem. Our G-code troubleshooting checklist pairs well with a quick look at who last edited the program.
FAQ
What is the difference between a role and a permission?
A permission is a single action, such as editing a tool record or viewing costs. A role is a bundle of permissions for a job function, such as operator or programmer. Assign roles to people and adjust the bundles, rather than assigning permissions one at a time.
Should operators be able to edit cutting parameters?
Usually not on master data. Operators work at the machine and often know when a speed needs tuning, so give them a way to log notes or request a change. A programmer or manager then approves and updates the master. That keeps the source of truth consistent and accountable.
Is a shared shop login ever acceptable?
We advise against it. Security guidance such as the VDW guide on machine tool IT security says accountability for changes is impossible with shared logins. Named accounts also let you remove one person's access without disrupting everyone else.
How often should we review who has access?
Quarterly is a sensible rhythm for most shops, and also whenever someone changes role or leaves. Practitioner guidance such as the EMS Handbook recommends regular reviews to counter permission creep. Pair the review with a look at the audit log.
Can AI in CNC software replace the programmer who approves programs?
No. Industry coverage such as CloudNC's analysis of whether AI will replace machinists says judgment tasks like safety verification and troubleshooting stay with people. Set permissions so that only qualified people can approve AI-assisted output for production.
Sources
- RBAC in Manufacturing: Roles, Rights & Governance (Symestic)
- Secure by Demand: Priority Considerations for OT Owners and Operators (CISA)
- Adapting Zero Trust Principles to Operational Technology (CISA)
- Site-based RBAC for manufacturing (Cisco)
- IT Security in Machine Tools (VDW)
- Manufacturing Security: RBAC, Personas, and Access Control (EMS Handbook)
- Explaining ISO 9001 Clause 7.5.3 Control of Documented Information
- AI coding assistants and manufacturing (MDPI Computers)
- Will AI replace machinists? (CloudNC)