7

I have a bit of a predicament. I run an app where staff can 'feature' posts on a special section. So if a staff member sees a post he or she likes, they can put it on the special featured section. But to do this, staff members will receive EXTREMELY sensitive credentials in order to access a private staff area.

The process of featuring is that they must input data in a database in order for it show in the section. Features are irreversible, so there is room for ABSOLUTELY NO MISTAKES. But if a traitorous staff member decides to give away private information about the staff area, then that could compromise our app.

The problem I'm having is that there is a rumor that staff members have been working with a rival app and some other staff members are plain immature. So in short, I can't trust a lot of staff members.(But don't get me wrong, there are some staff members I completely trust)

So how should the feature process work? Should staff members need approval from an administrator in order to feature? Should ONLY staff members that I trust be able to feature without approval first?

2 Answers 2

11

Features are irreversible, so there is room for ABSOLUTELY NO MISTAKES.

In the first instance I'd look at fixing this.

Ideally nothing should be irreversible (I know that it's not always possible, but you should have that as your goal). If the "featuring" process is made reversible then if someone does do something inappropriate it's easy to roll back.

If this isn't going to be possible in the short to medium term then perhaps you need to look at setting up a review queue for featured posts. Staff post to this in the same way as they would now, but instead of being automatically featured the post is only featured when another set of eyes have looked at it and said "yes".

Other than that, you have to trust your staff but make them aware that if they break the rules then their rights to feature posts etc. will be taken away.

Other options might include changing the credentials they need on a regular basis and only issue the current ones to those people who actually need it, but that might antagonise people more.

8

I see a few areas that need to be worked on in your situation

I can't trust a lot of staff members.

I think this is your biggest issue. Why can you not trust these people? If they are your staff you should be able to trust them. If you can not, they need to be removed from a position of power. If you are unable (or unwilling) to remove staff members over this particular issue, then you may need to consider a segregation of duties. The members you trust can post featured content. Those you do not, can not.

However, you need to be aware of what this segregation will look like to your staff. It will look like favouritism. It will appear that you trust some members more than others. While this may be true, you don't want it to look that way. Your "untrusted" staff will become resentful. If they are "traitorous" now, imagine how they will behave when they don't think you trust them. It'll get worse.

If you are segregating duties, make sure you are splitting out more than this single function. Even those you don't trust to handle this specific aspect should be able to do something. If not, why are they one your staff?

Features are irreversible, so there is room for ABSOLUTELY NO MISTAKES

As ChrisF mentioned in his answer, very little should be irreversible. It sounds like you have some control over the platform. Make changes so that mistakes can be rolled back. Even your most trusted user will make a mistake once and a while. You need to be able to fix that.

staff members will receive EXTREMELY sensitive credentials in order to access a private staff area.

This sounds like you are sharing credentials. Don't do that. Give each member of the staff their own credentials that you can revoke if necessary. Additionally, you should have logging capabilities within (at least) the staff area. This way you can see who is doing what. If someone is accessing information they really don't need you now know. You don't have to rely on "rumors". You can see exactly what they accessed.

So how should the feature process work?

You have a few options here. Your first option I've already mentioned; segregate your staff duties. Give groups of your staff specific abilities that other staff can not perform. This adds a bit of a checks and balances system to your organization. It will slow down things getting down though.

Another option is to require approval of featured posts. This approval can come from either other staff members. If a set threshold of other staff approve a featured post, it becomes featured. The approvals could come from administrators/owners. If you the person/people above "staff" approve a post, it becomes featured.

Overall, I think your issues are not technical in nature - though a technical solution will help protect from mistakes and intentional abuse. Your issue seems to be the lack of trust within your organization.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.