Temporary and external access.
WHAT TO GIVE
Their own account, in their name The minimum access for the task Time-limited, where possible
WHAT NOT TO GIVE
Your own credentials Administrator access for a content task Registrar access Anything they do not need
WHY NOT YOUR OWN CREDENTIALS
They gain access to everything, and you cannot revoke it without changing your own password.
WHAT TO AGREE IN WRITING
What they have access to What they may do with it That they will not share it When it ends
WHEN THE WORK ENDS
Remove it the same day.
WHAT TO CHECK AFTERWARDS
Whether they created additional accounts Whether any keys were added Whether any third-party service was connected
THAT LAST ONE
Connections authorised during a project and forgotten.
FOR ONGOING RELATIONSHIPS
Review annually, as you would for staff.
WHAT TO DOCUMENT
Who has access, for what, since when.
