Case history: staff access control