I absolutely agree with this. Access should not be given automatically to all staff. I have to remember to go and remove access from staff members (which I usually forget.) and everyone gets access as soon as I add a client. There should be a feature where the admin can choose between either giving access to all or to decide on who should be given access to which client.