Start with the work that must be separated
Role planning works best when you begin with the tasks that should not sit in the same hands. Drafting templates, approving documents, moving matters forward, loading evidence and changing permissions all need different levels of access in a busy firm.
In Sandton or a Cape Town branch, the same matter can pass through more than one team before it reaches the file room or court bundle. If everyone sees everything, the system gets noisy and mistakes creep in, especially when deadlines are close and several people are editing at once.
- List the tasks that touch client work directly.
- Mark which tasks need edit rights and which only need viewing.
- Separate admin controls from casework tasks.
- Keep sensitive evidence folders away from general staff access.
Build groups around actual firm roles, not job titles alone
A title on a business card does not tell the whole story. Attorneys may review and sign off, but they may also need access to matters that are not theirs alone. Paralegals may draft, file and chase documents, while firm ops staff may manage onboarding, billing links, permissions and archive rules.
A useful structure is to group users by the work they carry out most often. That keeps the screen clean and reduces the chance that a junior user gets permission to change a template or close a matter by accident. It also makes handover easier when staff rotate between offices or practice groups.
- Attorney group for review, sign-off and matter oversight.
- Paralegal group for drafting, file prep and status updates.
- Operations group for setup, reporting and user administration.
- Read-only group for people who need visibility without editing rights.
Set permissions in layers so the file does not sprawl
Good permissions work in layers. The outer layer covers who can log in. The next layer decides which matters they can open. After that comes what they can change, download or send for review. This stops shared drives from turning into one large pile where everyone can wander through the same folders.
For legal document assembly, permissions should be tight around template libraries and clause sets. A template specialist may build and update a form, but ordinary users should only see the approved version. Evidence imports need similar care, because scanned bundles, screenshots and attachments can carry sensitive material that should not sit in general access.
- Limit template editing to a small approval group.
- Use matter-level access for files that must stay team-specific.
- Separate download rights from view-only rights where needed.
- Give admin control only to named users.
Match deadlines and matter stages to the right people
Role planning is not only about privacy, it also affects deadline control. A matter pipeline works better when someone is responsible for each stage, from intake to drafting, review, filing and archive. If a deadline slips, the right person should see the matter flagged without having to search through every folder.
For firms in Pretoria, Durban or Bloemfontein, where multiple matters may move at once, stage-based access helps keep work orderly. It also lets operations teams see where a file has stalled, whether it is waiting on an affidavit, a signed instruction or an evidence pack. That view is useful, because a late handover can affect the next step in the process.
- Assign a matter owner for each live file.
- Set stage flags for drafting, review and filing.
- Use alerts for overdue actions and missing documents.
- Keep a record of who changed a matter and when.
Treat evidence and client data as separate risk zones
E-discovery work calls for careful handling, not just neat folders. Searchable review queues should be limited to people who need to assess documents, tag relevance or move items into a review stage. Client data, affidavit drafts and evidence bundles should not all sit under the same broad permission set.
Security should stay practical. Strong passwords, role-based access, logs of user activity and controlled sharing are part of day-to-day discipline, not just compliance talk. POPIA matters here in general terms, because the firm needs to protect personal information without making the system hard to use.
- Keep evidence review separate from general matter browsing.
- Use log records for access and edits.
- Review access when staff change roles or leave.
- Restrict exports where sensitive files are involved.
Review the setup before the firm opens it wider
Role design should be checked against real work, not only against an org chart. A firm can test the setup with a live matter, see which people can open, edit or approve each step, then trim away access that is not needed. That review should include branch teams, support staff and anyone who handles onboarding or template maintenance.
When the structure fits the work, training becomes easier and support calls are fewer. People know where to find their matters, what they can change and which steps need a second pair of eyes. That keeps the daily rhythm steadier, even when multiple deadlines land in the same week.
- Test with one active matter before wider rollout.
- Check permissions for every branch and team.
- Confirm that admin rights are limited and logged.
- Update roles after staffing or process changes.
