Published October 12, 2026.
Inventory identities and ownership first
Growth work often spans analytics, advertising, CRM, email, social, design, automation, domains, and shared storage. Before disabling an account, list direct logins, single sign-on access, API keys, service accounts, browser sessions, shared credentials, and client properties. Identify assets the departing person owns: dashboards, audiences, scheduled posts, forms, files, automations, and billing relationships. Transfer ownership to named business accounts rather than another temporary personal account. This prevents a routine access change from breaking production work.
Preserve legitimate records, not personal copies
Determine which work products and decision records the business must retain under its policies and agreements. Move them into approved shared storage with appropriate permissions. Do not indiscriminately copy personal messages or unrelated data. Capture current campaign schedules, automation status, unresolved exceptions, vendor contacts, and recovery codes through a controlled handoff. If the person used local exports, confirm their approved disposition without asking them to send sensitive data through an unapproved channel.
Revoke in a deliberate sequence
For a planned departure, complete ownership transfer and handoff before revoking access at the agreed time. For a security event, the authorized security owner may require immediate containment. Disable the central identity, revoke sessions and tokens, rotate shared secrets, remove platform roles, and verify external collaborator lists. Check that critical service accounts still have valid owners and that integrations use business-managed credentials. An assistant can maintain the checklist and evidence; privileged changes should be performed or approved by authorized administrators.
Verify the system after removal
Test customer-facing forms, scheduled campaigns, integrations, dashboards, and alert destinations. Confirm the former identity no longer appears in active-user and external-sharing reports. Record each action, operator, timestamp, exception, and follow-up owner. Schedule a second check after token or recovery windows have passed. Finish with a process review: unexpected ownership dependencies and undocumented shared credentials are signals to improve onboarding and access design, not merely problems to fix during the next departure.
