When is the best moment to discuss & define access rights, and what are the steps to be taken?
The below chart shows a step by step approach that can be used as a starting point (although of course it needs to be customized based on the processes of the company/entity it is rolled out in).

You might also be interested by our "User Access Form" available in the Document Control Toolbox:
Share this!