Elias spends his mornings in a workshop that smells of saltwater, sawdust, and the sharp, metallic tang of WD-40. He restores vintage wooden boat engines-magnificent, temperamental beasts that require a specific kind of patience (the internal combustion engine was essentially perfected by 1920, and we’ve mostly been adding plastic ever since).

If you ask Elias who handles his inventory, he points to a series of weathered cigar boxes. If you ask who manages his client relations, he pulls a grease-stained ledger from a shelf. Elias is the CEO, the head of procurement, the lead mechanic, and the guy who sweeps the floor at 5:30 PM. He is a multi-role entity, a human Swiss Army knife operating in a space where “job descriptions” are just words people use to feel important in air-conditioned buildings.

The Silo Solution for the Garage Reality

The trouble started when a consultant, well-meaning but possessed by the spirit of a thousand middle-managers, suggested Elias needed a “Role-Based Access Control” (RBAC) system for his digital records. The consultant spoke of silos and permissions-the digital equivalent of a high-security fence-as if Elias were a Fortune 500 company instead of a man who occasionally forgets where he put his 7/16th wrench.

The pitch was simple: Admins get this, Users get that, and Power Users get the other. But in Elias’s world, he is all three before his first cup of coffee is cold.

This is the fundamental friction of the small-to-medium business (SMB) world. We are told that order comes from categorization. We are sold software and licensing models built for the scale of a skyscraper, then told to live in them while we’re still working out of a garage. The rational role taxonomy (a fancy word for a naming system) assumes a division of labor that simply does not exist when your “IT department” is just Dave, and Dave also handles the payroll and the plumbing.

I felt this friction myself tonight. I was on a conference call discussing “enterprise-grade governance structures” while my dinner-a perfectly good pan of chicken thighs-slowly transformed into charcoal in the kitchen. I was trying to play the role of the “Focused Professional” while my “Domestic Coordinator” role was screaming about smoke detectors.

The scorched smell of carbonara is a visceral reminder that we do not live in silos; we live in the overlap. In a large organization, roles are a safety mechanism. They prevent the marketing intern from accidentally deleting the production database-a catastrophic event known as “The Tuesday from Hell.”

But in a ten-person firm, those same roles are a straightjacket. When you import a rigid role structure designed for a global bank into a firm that fits in a single zip code, you don’t get security. You get a team that spends 40% of its energy pretending to be an org chart it isn’t.

“The most dangerous thing in a load-bearing structure isn’t the weight it carries; it’s a joint that’s been painted over so many times it can’t move anymore.”

– Simon S.-J., Bridge Inspector

A bridge that cannot sway in the wind will eventually snap. The same is true for a small business. Its strength is its fluidity-the ability for the lead engineer to jump into sales when the phones are ringing off the hook.

The License Logistics Nightmare

When we try to apply Role-Based Access (RBA) to this fluid reality, the licensing usually falls apart first. Most enterprise licensing models are built on the assumption that “User A” will always do “Task X.” But in a small shop, User A is doing Task X, Y, and occasionally Z when the neighbor’s Wi-Fi goes down. This is where the debate between User CALs and Device CALs usually gets messy.

Client Access Licenses (CALs) are the permission slips of the server world. A User CAL-a license tied to a specific human-makes sense if that human is a “Role.” But what if that human uses three different laptops, a tablet, and a ruggedized scanner in the warehouse? Or what if you have fifteen part-time employees sharing three workstations? (The average lifespan of a warehouse scanner in a humid environment is only about 14 months).

The consultant wants you to map your people to roles, but the people are moving too fast. If you try to follow the “Big Org” playbook, you end up buying 50 User CALs for a 10-person company just to make sure nobody gets locked out of the system during a shift change. It’s a deferred tax-a hidden cost of pretending to be bigger than you are.

The reality is that small firms need a different kind of order. They need the kind of licensing and access that respects the “everyone-wears-five-hats” rule. When you’re looking to get your environment set up without the bloat of enterprise-grade bureaucracy, you need a source that understands the math of the small shop.

Provisioning-the act of setting up a user’s access-shouldn’t feel like an interrogation. In a large firm, you might have a “Provisioning Specialist” whose entire job is to click checkboxes in an Active Directory menu. In your world, that specialist is also the person trying to figure out why the printer is making that clicking sound again.

The Profound Efficiency of the Informal

If the software demands that you define a “User Manager” and a “Compliance Officer” before it lets you share a folder, the software is the problem, not your business. We have been conditioned to believe that informality is a sign of weakness. We think that because we don’t have a 40-page “Acceptable Use Policy” or a tiered hierarchy of access, we are somehow less professional.

But there is a profound efficiency in the informal. When Elias needs a specific part, he doesn’t file a requisition; he goes and gets it. His “access policy” is the fact that he owns the shop. The “Identity Crisis” of the small business server happens when the software starts asking questions the business can’t answer.

“Who is the administrator?” the screen asks. Well, today it’s Sarah because she’s the only one who remembers the password, but tomorrow it might be Kevin. If the system is too rigid to handle that handoff, the system is a liability.

The Sword of Granularity

Granularity-the level of detail in a system-is a double-edged sword. At a high level of granularity, you can control exactly who sees which pixel of data. But the cost of that control is complexity. For a small business, the goal should be “Minimum Viable Bureaucracy.” You want enough structure so that the data is safe, but not so much that the data is inaccessible to the people who need it to survive the week.

This brings us back to the licensing. Choosing between User CALs and Device CALs isn’t just a technical decision; it’s a reflection of how your team actually moves through space. If your people are stationary, tied to specific desks like plants in a nursery, Device CALs are your friend. If they are nomadic, moving from the office to the field to the home, User CALs are the only way to keep your sanity.

But don’t let the enterprise vendors tell you that you need to “evolve” into a role-based structure. Your ability to ignore silos is why you’re still in business. It’s why you can pivot faster than the giants. It’s why Elias can restore an engine that hasn’t run since the Truman administration while the “big guys” are still waiting for a committee to approve the purchase of a new gasket.

The engine of a small business runs on the heat of the same hands that turn every single bolt.

We spend so much time trying to fit into the costumes of “Big Business” that we forget the costume is what slows us down. A role is just a script. If you’re the director, the actor, and the stagehand, you don’t need a script; you need a stage that doesn’t collapse when you move from one side to the other.

When I finally scraped the burned chicken off my pan tonight, I realized that I had failed at my “Domestic Coordinator” role. But I had succeeded at my “Consultant” role. The chicken didn’t care about my titles. It just cared that I left the heat on too high for 18 minutes. The server doesn’t care about your titles either. It just needs to know that the person asking for the file has the right to see it.

Don’t build a digital cage for a business that needs to fly. Keep your permissions broad, your licensing simple, and your roles fluid. If you try to map every hat you wear to a different login, you’ll eventually run out of heads. Stay messy, stay fast, and let the big companies worry about their silos. You have engines to build and printers to fix.

The number of hours wasted by small business owners trying to navigate enterprise-grade permission menus in 2023 was estimated to be roughly 1,412 per company. Don’t let your firm be part of next year’s statistic. Trust the informal. It’s the only thing that actually works when the smoke detector starts going off.