How do I know how much access to give someone?

Resetting a password is a task. Deciding what someone should be allowed to touch is a judgment, and judgments feel shakier. When you grant too much, you worry you have opened a door. Too little, and you have blocked someone's work. That back and forth is the honest hard part of the job. There is a simple rule that cuts through most of it. Give the least access the person needs to do their role, and no more. When in doubt, grant less. It is far easier to add a permission later than to discover you gave away too much. Before your next grant, ask the person what they actually need to do, not what they want access to. Match the permission to the task in front of them. And when the task ends, take the access back. Least needed, for as long as needed, is a rule you can lean on.