Yes, but usually not by opening the same level of access to every user.
The practical pattern is to separate who can view summary information from who can drill into underlying records, and then control drill-down by role, site, program, product, supplier, or record type. Auditors and quality personnel may need deep evidence access. Most other users do not.
In regulated environments, that typically means combining several controls rather than relying on a single permission setting:
- Role-based access control so users only see the functions and records appropriate to their role.
- Record-level or attribute-level security to limit visibility by plant, work center, part family, customer program, supplier, or document class.
- Read-only audit workspaces or reports that let auditors trace from KPI or exception to underlying transaction, document, and approval history without exposing unrelated records.
- Evidence links back to source systems so a drill-down lands on the governed record, not a disconnected export or screenshot.
- Full audit trails for who viewed, changed, approved, or exported records, where the platform supports it.
If the question is whether one dashboard can safely serve operators, supervisors, executives, quality, and auditors with no additional design, the answer is usually no.
Drill-down access is only trustworthy if the underlying data model, identity controls, and integrations are disciplined. In many plants, the top-level metric may come from a BI layer, while the detailed record lives in MES, ERP, QMS, PLM, or a document repository. If those links are weak, users can drill into stale, incomplete, or mismatched data. That is a governance problem, not just a UI problem.
What usually works
A controlled approach often includes:
- Tiered visibility: broad access to approved summaries, narrower access to detailed records, and highly restricted access to sensitive fields.
- Context-aware filtering: users can drill only into the site, line, product, customer, or quality scope they are authorized to see.
- Predefined audit paths: for example, from a nonconformance count to the NCR, then to disposition, approvals, attachments, and linked production history.
- Masking or redaction for commercial, export-controlled, personnel, or supplier-sensitive data where applicable.
- Controlled exports: allow viewing when needed, but restrict bulk download or uncontrolled sharing.
- Change-controlled report definitions: if a report supports audit or release decisions, its logic should be versioned, reviewed, and managed accordingly.
What can go wrong
Common failure modes are predictable:
- Users can see a chart but cannot reach the underlying evidence, so the metric is not defensible.
- Users can drill too far and see unrelated programs, suppliers, or plants.
- BI permissions do not match source-system permissions.
- Exports bypass retention, traceability, or document control practices.
- Master data inconsistencies cause one summary metric to map to multiple underlying records, or none at all.
- Security models become so complex that plants start sharing generic accounts or offline files to get work done.
That last point matters in brownfield environments. If MES, ERP, QMS, PLM, and reporting tools each have different role models, identity stores, and naming conventions, drill-down security becomes brittle fast. Full replacement is rarely the clean answer in long-lifecycle regulated operations because qualification burden, validation cost, downtime risk, and integration complexity are high. In practice, most organizations improve access control by federating identity, tightening system-to-system mappings, and creating governed audit views over existing systems.
So the short answer is: give broad access to approved summaries, and limited, traceable drill-down to governed source records based on role and scope. Do not assume dashboard access alone solves evidence access, and do not assume one security model will fit every connected system without careful integration and validation.