I'm busy with a redesign of a telephony management system, where just one example of shocking design was storing employee information in the phone extensions table. I have done many normalisations like this, factoring out employee information, but I am now faced with the decision of whether to factor 'system user' information, such as access rights, password, etc. out of the Employee table into a User table. No information would be duplicated across the tables, but two records will always have to be created, destroyed when maintaining users.
My reason for considering a second table is that not all Employees will always be users (There are plans to increase the scope to not only manage telephony), and not all users will be employees, e.g. us, the vendor should also be able to log in and perform maintenance without the bureaucratic hassle of direct database access.
I'm not asking for a yes or no here, but some advice on data I should collect and assess to make this decision. The decision is mine to make.