When it is not the customer contacting.
WHO CONTACTS
Developers working for a customer Agencies Family members Employees of a business account People claiming authority
WHAT TO ESTABLISH FIRST
Whether they are authorised.
HOW
Confirmation from the account holder, recorded.
WHAT TO AVOID
Accepting a claim of authority Disclosing anything before verifying
WHY
It is a common route to account takeover.
WHAT TO DO WHEN AN AGENCY CONTACTS
Ask the customer to authorise them, in writing.
WHAT TO RECORD
Who is authorised, for what, and until when.
WHY UNTIL WHEN
Relationships end, and access should not persist.
WHAT TO BUILD
Named contacts on an account, with defined permissions.
WHY
It replaces judgement with a record.
WHAT TO DO ABOUT A DEVELOPER ASKING FOR ACCESS
Have the customer create an account for them, rather than sharing credentials.
WHY
It is attributable and revocable.
WHAT TO DO WHEN AUTHORITY IS DISPUTED
Stop, and escalate.
WHAT EXAMPLES LOOK LIKE
A business partnership breaking down An employee who has left A developer in a dispute with their client
WHAT TO NEVER DO
Take sides in an ownership dispute.
WHAT TO DO INSTEAD
Act only on instruction from the recorded holder, and take advice if contested.
