When Norman enters Engineering and Scotty is slugged, Scotty falls back and clutches the end of the control console near the comm station. A close-up shows Scotty warning the Bridge from that station. But in the next wide shot of Norman dispatching the rest of the Engineering staff, Scotty is not there. We then get another close up of Scotty passing out at the comm station.
When android Norman first comes on board the Enterprise and starts to take over the Engineering section, there's a red-shirt crew member who's presumably about to dive from the upper platform area onto Norman, but he's going in a direction AWAY from the android. Yet in the split second jump cut, he lands directly on top of Norman.
It is never explained how Norman got posted aboard the ship to begin with. The ship's personnel officer (seen in Star Trek: Court Martial) would presumably have to verify his orders and background with Starfleet Command.
The goof item below may give away important plot points.
When Norman is on the Enterprise, he is not wearing a communication necklace, which implies the necklaces are not necessary for androids to function. However, it seems to be required when an android is processing incoming information or responding to requests for information - particularly illogical or disjointed information.
Mudd refers to sending androids up to the Enterprise to send Scotty and the rest of the crew to the planet, however there was no permission granted to do so by any command authority, and the crew would not have transported the androids up without authorization.
Norman, the coordinator of all the androids, would never have allowed himself to be sent to hijack the Enterprise. He would have evaluated the risks to the android population as too great in the event he failed and was destroyed.