The brief from Somerset West
The client was a hospitality group based in Somerset West with branch teams spread across front of house, management, kitchen, finance and support roles. They needed one password process that worked across locations, reduced shared logins and made it easier to control access when staff moved between branches or left the business.
The main request was simple enough to say but harder to run day to day. They wanted password management and single sign-on that fit a busy hospitality operation, where shifts change often and not everyone needs access to the same systems. The group also wanted a cleaner process for new starters, seasonal staff and offboarding when someone left mid week.
What was slowing them down
Before the rollout, each branch handled access in its own way. Some passwords were shared over chat, some were written down and a few admin accounts had more access than they should have. That created delays when staff needed a login reset, and it made audits harder because nobody had a full picture of who could reach what.
- Shared logins across branch teams
- No standard offboarding process
- Different password habits at each site
- Admin access not tied neatly to job roles
- Too much time lost on reset requests and handovers
In hospitality, a missing login can hold up rostering, stock checks, payroll updates or bookings. The group wanted less back and forth, and a setup that would still make sense if load-shedding or a busy service period knocked staff off schedule. That meant keeping the process straightforward and well documented.
How we structured the rollout
We started with an initial security review to map the systems in use, identify the main users and decide which accounts should be shared, personal or restricted. From there we built a vault structure around departments and branch roles, rather than around individuals. This made it easier to control access as staff changed positions.
- Initial security review and account mapping
- Vault structure designed by department and branch
- Permission mapping for managers, supervisors and support staff
- SSO configuration for everyday business tools
- Password migration from existing storage methods
We also set up a simple naming convention for logins and shared folders so branch managers could find what they needed quickly. The setup was kept clean and practical, with enough control for management but not so much complexity that branch teams would ignore it.
Training for branch managers and admins
Training was split between day to day users and the people responsible for access control. We ran user onboarding training for staff who needed to log in and retrieve credentials, then separate admin training for managers and head office support. That way each group knew exactly what they were allowed to do and what needed approval.
We covered password creation rules, secure sharing, account handovers, new starter setup and the offboarding process. We also showed the team how to handle urgent changes when someone was off shift or not reachable. A good process only works if people can use it when the restaurant is full and the phones are busy, so we kept the training short, practical and repeatable.
- One hour user sessions for branch teams
- Admin walkthroughs for managers and support staff
- Offboarding steps for leavers and seasonal staff
- Quarterly access reviews for ongoing control
Timeline and delivery in six weeks
The project ran over six weeks from first review to full handover. Week one covered discovery and access mapping. Weeks two and three were used for vault design, SSO setup and permission planning. Week four handled password migration and test access for key staff. Week five focused on training. Week six was used for live support and final adjustments after the team had used the system in real conditions.
Because hospitality teams work across shifts, we scheduled sessions around branch trading hours and manager availability. That kept disruption low and meant the rollout happened without slowing service. The process was paced to suit a working group, not an office with one fixed timetable.
Results for the group
After rollout, branch access was easier to manage and much clearer for the people handling it. Managers could see who had access to which tools, and the business had a standard process for onboarding and offboarding instead of relying on memory or informal handovers. Password requests dropped, and there was less confusion when staff moved between branches.
- One access structure across all branches
- Better control over shared and personal accounts
- Faster onboarding for new team members
- Cleaner offboarding when staff left or changed roles
- Improved visibility for quarterly access reviews
The group also found that it was easier to keep branch teams aligned. Instead of each site managing passwords in its own way, they had one standard procedure that could be followed by managers in Somerset West and support staff elsewhere. It made daily operations steadier, and less dependent on who happened to be on duty that day.
What we would do again
For a hospitality group with multiple branches, we would use the same approach again. Start with a proper review, build access around roles, train managers separately from general users and keep the offboarding steps very clear. That combination gives the business better control without slowing down operations.
If the group opened more branches in future, we would extend the same structure rather than starting from scratch. The setup can scale well because the rules are already tied to the way hospitality teams actually work, with rotating shifts, seasonal staff and a need for quick action when someone changes role.
We would also keep quarterly access reviews in place. They are a small task, but they help catch old accounts, unused permissions and anything that has drifted since the last staffing change. In our experience, that is where many businesses slip up, not in the setup but in the follow-through.
Key facts
| Client type | Hospitality group |
|---|---|
| Project location | Somerset West |
| Rollout time | 6 weeks |
| Core scope | Password management and single sign-on |
| Access model | Role based by branch and department |
| Support model | Remote onboarding and ongoing team support |
