A three tier access scheme, the demonstrated task checklist that moves a user between tiers, who signs it, and the recertification and succession rules that stop a facility losing a capability when one student graduates.
An instrument breaks about a year after installation, and the incident report says a student was using it unsupervised. The interesting question is not what they did. It is who decided they were ready, on what evidence, and whether anyone else in the building could have answered that question the day before. In most laboratories the honest answer is that a supervisor said it was fine because the student was busy and the instrument was free.
Access should be a status a person holds, recorded against the instrument, not a favour granted in the moment.
That reserved list is short and it should be the same across the facility: venting or baking a chamber, changing a source or a filament, changing a detector, handling cryogens or a radioactive source, altering the instrument configuration, and anything involving a new material whose behaviour under the beam or in vacuum is unknown.
What moves a user from supervised to independent should be demonstrated tasks, not hours accumulated. A checklist for an electron microscope might require the user to, on their own and without prompting, mount and unload a sample without contacting the pole piece or dropping it in the chamber, bring the instrument to imaging condition from standby, recover from a specific named fault, read the vacuum status and explain what the interlock is protecting, save data to the correct location with the correct naming, record the session in the log, and shut down to the state the next user expects.
Two details make the checklist stick. It is signed by the instrument custodian, not by the student's own supervisor, so that certification is a facility decision rather than a departmental courtesy. And anything with a serious hazard behind it, a laser, a cryogen, hydrogen or a sealed source, takes a second signature from whoever holds that safety responsibility.
Print the envelope and the reserved list and put them on the wall beside the instrument. A policy in a shared drive is a policy nobody reads at eleven at night, which is exactly when the mistakes happen.
Certification should lapse. A fixed interval is the simplest rule, and three events should trigger an immediate short recertification regardless of the calendar: a long absence from the instrument, a service intervention that changed the interface or the software, and any incident on that instrument by anyone. Recertification is a single supervised session against the same checklist, not a repeat of the full training, so it costs the facility very little.
The larger structural risk is that competence in most research groups is one person deep. A single student learns the instrument, becomes the group's route to data, and takes the capability with them when they submit. The facility then finds that a working instrument has gone quiet because nobody left in that group can use it.
Two rules fix it and neither costs money. Require two certified users per group before the group gets independent booking rights, so competence is always duplicated. And make the departing certified user deliver the training for their replacement, supervised by the custodian, before their thesis is submitted. That converts an individual skill into a group asset and it gives the outgoing student something concrete for their record.
Charging can reinforce the whole structure rather than fight it. If assisted sessions carry a higher hourly rate than independent ones, because they consume technician time, groups have a direct financial reason to get people trained and recertified rather than leaning on the custodian indefinitely. The tier system then pays for the training it requires.