The new starter needs access now. Can you grant it?
An urgent request still needs the right approval.
The question
Bellmere is a fictional healthcare group with clinics, offices and a supply warehouse. A new starter must process supplier invoices this morning. The access request and procedure below are authored practice evidence.
- New starterI can sign in, but the invoice screen says 'Role required'. I have already signed out and back in.
- Line managerPlease copy my account's permissions. The team is behind and we can finish the paperwork later.
- Identity
- The new starter's identity is verified through the approved channel. The account is active and login succeeds.
- Requested role
- Invoice Entry: create draft invoices. It cannot approve invoices or release payment.
- Approval state
- Line-manager approval is present. Finance application-owner approval is missing. The line manager's account also has invoice-approval rights.
The service desk may assign a named application role only after identity verification and both line-manager and application-owner approvals are recorded. Do not copy another user's permissions or share accounts. The finance application owner can provide an approved alternate work arrangement while the request is reviewed.
“Explain the fault, respond to the manager, and move the request forward without granting unauthorized access.”
Not saved by this site. Your browser may restore text when you navigate back.
A strong answer, step by step
Open each step in turn. This is one strong answer, not the only one.
Step 1: Separate login from permission
What would you do here? Open the move you’d make.
Check the requested role and approval record
The strong move. The visible error and successful login point to application authorization.
Run the standard password reset first
Tempting, but it misses something. Login already succeeds and the user repeated the session check. A reset would not resolve the missing role.
See how a strong candidate says it
“The account is active and login works. The missing invoice role is an authorization issue. Another password reset or reinstall would not supply that role.”
Why it works: An access error does not always mean that authentication failed.
Step 2: Apply the supplied approval rule
What would you do here? Open the move you’d make.
Treat the manager's urgency as temporary approval
Tempting, but it misses something. The procedure does not give the line manager authority to replace application-owner approval.
Request the missing application-owner approval
The strong move. This is the remaining condition in the supplied procedure.
See how a strong candidate says it
“Identity and manager approval are recorded, but Finance's application-owner approval is missing. I cannot assign Invoice Entry yet, even though the request is urgent.”
Why it works: The record satisfies some conditions, not all of them.
Step 3: Do not copy excessive permissions
What would you do here? Open the move you’d make.
Keep the request limited to Invoice Entry
The strong move. It fits the stated task and avoids adding approval or payment authority.
Copy the manager's access and remove extra rights later
Tempting, but it misses something. That grants unrequested approval rights and bypasses the named-role procedure.
See how a strong candidate says it
“I would request Invoice Entry only. Your account includes approval rights that the new starter did not request. I cannot copy it or suggest that someone shares an account.”
Why it works: A working colleague's account is useful comparison evidence, not a safe permission template.
Step 4: Give a useful next step
What would you do here? Open the move you’d make.
Mark the ticket awaiting approval and end the conversation
Tempting, but it misses something. The status is accurate but gives the user no owner, next action or update commitment.
Send the complete approval request and set an update
The strong move. The owner can act without asking the user to repeat the whole request.
See how a strong candidate says it
“I will send Finance the verified identity, requested role, manager approval and urgency, and ask the owner for approval or an approved alternate arrangement. I will update you at 10:00. I cannot promise access before Finance decides.”
Why it works: A justified stop still needs an owner, evidence and a user update.
The answer, in short
- Decision
- Stop the grant and route a complete, limited-role request to Finance.
- Because
- Application-owner approval is missing, and the manager's account has rights beyond the new starter's task.
- What would change it
- Recorded owner approval for Invoice Entry would allow the service desk to assign that named role under the supplied procedure, then ask the user to verify the permitted task.
Common traps
- Confusing a successful login with permission to use every feature.
- Copying a senior colleague's broader rights.
- Stopping safely without owning the next step.
Check your answer
- Did you identify authorization rather than reset a working login?
- Did you require both approvals in the supplied procedure?
- Did you reject account sharing and the manager's broader permissions?
- Did you give Finance the evidence and the user an update time?
Last reviewed Nov 10, 2026