>>106983336
Deny all then access only what they need for work. Classic ACL level of management. Who ever cries the loudest gets a consideration for what they might need.