One Login for Three Shifts: The Shared Warehouse Account

The failures compound, but they are not equal in severity.

1. No accountability. Fourteen staff and six temps share one credential, so the WMS log can only ever say 'packbay'. The missing-pallet investigation died for exactly this reason. Without attribution you cannot deter, detect or discipline.
2. No revocation. When a temp leaves, the only way to cut access is to change the password for everyone mid-shift, so in practice nobody does it. Dismissed staff keep working credentials.
3. Broad privilege. Pickers hold stock-adjustment and label-reprint rights they do not need; reprinting labels is a known route to diverting deliveries.
4. Trivial credential capture. A written password plus an unattended logged-in terminal means anyone on site - cleaner, driver, visitor - is effectively an insider.

Fix first: revocation and attribution together, because they are the same change - individual identities. Severity here is driven by likelihood (temps churn constantly, the password is public inside the building) and by detectability: the shared account blinds every other control. A shared password is an inconvenience; an unattributable account is an incident you cannot investigate.

The constraints are real: safety rules out phones, and a long password per scan will be defeated by staff within a week. Design around the constraint rather than arguing with it.

• Badge tap plus 4-digit PIN on the terminal. The proximity card identifies the person; the PIN proves the card was not borrowed. A tap-and-PIN happens once at the start of a shift, not per scan: the session stays open while the operator is at the station and locks after 60-90 seconds idle, re-opened by tap alone within a short window.
• Role-based groups. wh_picker, wh_packer, wh_supervisor. Stock adjustment and label reprint move to supervisor-only, with the supervisor's badge tap recorded as the approval.
• Temps on the same mechanism, with an expiry date set at creation. No separate 'temp account', no shared credential.
• Supervisor override logged and reviewed weekly, not merely enforced.

Why this survives: the 90-second target is about handling time per item, and one tap per shift barely touches it. The ops manager's real objection is likely change cost, so pilot on one shift and measure throughput for a week; a measured result beats a policy argument. If proximity readers are unaffordable short term, a per-person PIN on the existing terminal is a strictly better interim step than the shared password - but only interim.

Temps are where shared accounts come from, so the answer cannot be 'give them the same login'. Treat the temp lifecycle as a defined process with three checkpoints.

Before day one: the agency supplies a named individual; the sponsor (shift supervisor) raises the request; the account is created with a hard expiry equal to the last rostered day, not 'until further notice'. No generic or shared accounts for temps under any circumstances.

On day one: badge and PIN issued to the named person, acceptable-use summary briefed in their language, signed acknowledgement. Group membership limited to wh_packer - no stock adjustment, no label reprint.

On the last day: expiry handles the planned case; the supervisor confirms badge return and the account is disabled the same shift, not when HR next processes paperwork. If a temp is dismissed mid-rostered-period, disabling is immediate and requires no password reset for anyone else - precisely the property the shared account lacked.

Standing controls: a weekly access review of the temp group against the agency roster (five minutes, one owner); a monthly reconciliation of active accounts against active badges; and the same forced-expiry pattern for every contractor. The failing in the missing-pallet case was not the temp - it was that removing access was impossible without collateral damage. That is a design defect, not a discipline problem.