A workplace alcohol check system is a tool that records the results of tests taken before clocking in or starting work and helps managers review those results to the extent necessary. Where you must decide whether someone can carry out that day's work, such as work assignment at manufacturing and construction sites or pre-duty and pre-departure checks in transport and aviation, both site supervisors and HR staff may need the data. But the scope of information the two departments need and the purposes for which they use it are not the same.
The site usually needs to know whether a given worker has completed that day's check and whether their work assignment should be put on hold. The HR department, on the other hand, handles matters such as objections, internal procedures, and changes of staff in charge, and may review related data. So rather than "HR sees all results because it is HR" or "site managers see all past results for their staff because they are site managers," it is more appropriate to start by deciding which person needs to see which screens and files for which task. The fact that Article 29 of Korea's Personal Information Protection Act requires safety measures, including establishing an internal management plan and keeping access logs, is another reason access should be designed by purpose.
First separate the information needed for each work situation
Divide access rights by actual actions rather than by job title or department name. What a site supervisor needs may be information tied to immediate action, such as whether people coming in for today's shift have completed the check, whether further checks are needed, and whether their work assignment should be put on hold. Whether there is also a need to show results for workers at other sites or that employee's long-term past records is a separate question to review.
Nor can you assume that HR staff must have constant access to all records. When a particular employee objects to a result, data to confirm the facts, such as the test time, handling progress, and whether anything was corrected, may be needed for that case. But the right to download records of other employees unrelated to the objection may not fit that work purpose.
Even if the system administrator handles account creation, role settings, and access problems, they may not need to see result content widely. It is better to check whether the product can separate settings management from result viewing and, if it cannot, record that limitation in the operating documents and set a separate control method. If you design roles assuming a feature exists, gaps will appear in actual operation.
Do not treat viewing and exporting files as the same right
The right to view results on screen, the right to edit results, the right to download them as files, and the right to delete data each create different risks. There needs to be a separate justification for giving someone who needs on-screen viewing for same-day assignment decisions the ability to download whole files as well. Conversely, if the person handling objections needs to check related data but viewing is overly restricted, workarounds may appear in which staff receive data through personal messengers or separate files to get the job done.
Edit rights in particular need to be separated. If someone can change result values or handling status, you must be able to see who changed what and when in order to explain the handling process afterward. Decide at the same time whether the system supports viewing change history and, if not, through what procedure edit requests and the fact of handling them will be recorded.
| Role | Information and actions needed for the work | Scope to restrict |
|---|---|---|
| Site supervisor | Check whether assigned workers completed today's check and whether assignment is on hold | Viewing other sites' data and unnecessary past records |
| HR staff | Review records and handling progress related to cases under objection | Bulk viewing or export of records of employees unrelated to the case |
| System administrator | Account and role settings, handling access problems | Constant viewing and arbitrary changes of result content |
| Temporary support staff | Outage response or specific handling support for a set period | Access rights that continue after the period ends |
The scopes in the table are not rules to copy as is for every organization but a starting point for building an access table. For example, even a head-office staff member who manages several sites can distinguish the items needed for regular reports from individual test records. The key is not to make the needed aggregate information and individual raw records viewable in the same way.
Test the scope of access rights with a hypothetical case
As a hypothetical example, suppose a site manager at Plant A checks whether the morning crew has completed their checks and assigns workers. Observe whether this manager can see only today's people subject to checks at their own plant on screen, with records from other plants and past results not opening. Then, with an HR staff account, check whether the related data for a specific case under objection can be viewed and, conversely, whether records of unrelated employees cannot be downloaded in bulk.
If you observe that the site account can search all past records and download files, access may be set more widely than same-day assignment decisions require. A possible action is to restrict past record searches or file exports for the site role and give the person handling objections a scope matched to the case handling period and subjects. The completion criterion is confirming, by logging in with a test account for each role, that the needed work screens open and that sites, periods, and files not permitted cannot be accessed.
Do not conclude that access is blocked just because a menu is not visible. Also check whether files open when the address is entered directly, whether the previous person in charge can still access shared storage locations, and whether the access scope of exported files remains. Using test data for checking permissions instead of real employee data in the test reduces unnecessary viewing.
Clean up access paths when the person in charge changes
Revoking access does not end with closing the system account of a departing employee or predecessor. Paths to results may remain, such as shared folders, shared links, storage locations of previously downloaded files, and shared accounts. It is good to include in the handover procedure not only account deactivation but also items for checking these storage locations and sharing settings.
With a shared account, several people use the same ID, so it is hard to tell who viewed results or changed settings. If system constraints require a shared account, you can consider separately recording when it was used, by whom, and for what purpose. Where possible, using individual accounts and handling grants and revocations person by person makes it easier to match the access table to the actual users.
Sometimes temporary access is needed for outage response or urgent objection handling. In that case, decide at the same time the screens or subjects needed, when the access will end, and who will confirm its revocation. This is to prevent access from remaining after the matter ends and hardening into regular access.
Regularly compare the access table with the actual screens
In the access table, record for each role the subjects it can see, whether it can view, edit, export files, or delete, and who approved and who configured it. Because what was approved may differ from the settings actually applied in the system, you need a procedure to check directly with a test account for each role. In particular, after personnel transfers, reorganizations, or changes of outside operating staff, it is time to re-check whether existing access still fits the work.
Keeping access logs alone does not complete the job. Records become a management tool only when you decide who checks them and when, and which role settings to change if broad viewing or unexpected file exports are found. The standard for separating access is to give the site the same-day decision information it needs and give HR the records needed to handle cases, while designing each role so it does not access other employees' results beyond what is necessary.
