Why not? Especially at the early stages when there aren't many people it should be easy to implement appropriate access levels.

As for an audit log, what's wrong with those capabilities built into most databases already?