Everyone became an admin. Nobody decided that.
Most small tools ship with one role: full access for everyone. That's not a security decision, it's the absence of one, and it's fine until it isn't.
One role is the fastest way to ship
When a small tool launches, adding roles takes real design time nobody has for an MVP - who can see what, who can edit what, who can delete what. The easiest path is that everyone gets the same account type. It works, because early on everyone is trusted and everyone is doing five jobs at once anyway.
The team outgrows the assumption before anyone notices
Six months later there's a part-time bookkeeper, a new hire on a trial month, an outside contractor with temporary access. They all get the same login as the owner, because that's still the only kind of login the system has. Nobody sat down and decided this - the software just never grew a second option.
The cost shows up on the wrong day
The real cost isn't a hypothetical breach. It's the trial-month hire who deletes an invoice by accident because delete was one click away and nothing asked if it was theirs to remove. It's the contractor who can see every client's pricing because there was never a version of the account that couldn't. Small mistakes, made possible by access nobody meant to grant.
The ACS approach
We treat roles as part of the first version, not a v2 feature - even two roles, owner and everyone else, beat one. Before we ship an internal tool, we ask what the worst accidental click looks like for each kind of user, and make sure that click isn't available to people who don't need it. Cheap to design early, expensive to retrofit once ten people already have full access out of habit.