If it's not one of your core goals from the very start of your design, it's pretty hard to build a system where employees can't access data. Obviously you can do it, but it's not trivial and it's doubly not trivial to add after the fact.