Password management must first be defined to avoid confusion as to how you want to implement and run it. Indeed, there are a multiple of variants for controlling access. Peter Stephenson reports