Note
Shared tablets on the floor, and why the log then means little
We still meet laminated passwords on the side of a tablet enclosure. The account is usually called Operator, Shift, or Guest. It can acknowledge alarms, change setpoints within a band, and sometimes request a vendor session.
From an availability view this is understandable. People have gloves on. Accounts expire. The night supervisor is covering two lines. From an audit view it means you cannot answer a simple question after an incident: who issued the command?
Malaysian sites that fall under the Personal Data Protection Act already keep CCTV and access-card logs with more care than they keep control-app identities. The control application is closer to the process than the camera on the loading bay.
A workable middle path we have seen: a short PIN per person on a shared device, mapped to a directory group that only holds plant staff, with a break-glass local account in a sealed envelope for network outages. It is not a full IAM programme. It is enough that the next investigation has a name besides “Operator”.
If your integrator insists the HMI licence is per seat and seats are expensive, put that constraint in the audit scope. We will say so in the report rather than pretend the log is something it is not.