The real limit of "use"
The "use" level prevents accidental viewing and keeps a record of who has the password. But to fill, the password has to reach the person's device; someone knowledgeable and malicious can see it with developer tools. That is why Passhield records this level not as a barrier but as "used" exposure, and recommends a change at offboarding.
On critical, bank and government accounts, having only used the password is a reason for a required change at offboarding too.
Practical advice
- Grant access to groups, not people; access changes on its own as people join and leave groups.
- Use grants with an end date for temporary needs; let employees ask for access themselves through access requests.
- Have at least two people at "manage" on every vault, so a vault is not left without an owner when one leaves.
- Exporting and sharing are at "manage"; give that level to few people.
- Look at the access map once a month: remove permissions that are never used.