This isn't a major one, but it is an inconsistency.
In Employees/DetailView.asc.cs the 'edit' button is turned on if someone is looking at their own record:
btnEdit .Visible = !PrintView && (SplendidCRM.
but in Employees/Edit.aspx the EditView is hidden if the current user is not an administrator.
This means a person can click 'edit' on their own record, but get an authorisation failure error.
(They can use 'My Account' so they're not ultimately hampered.)