Access Control
"How we grant, scope, and revoke access to our systems."
Why this exists
Access sprawl is how breaches happen at small teams. Someone gets admin access 'just in case,' leaves the project, and nobody revokes it. The principle of least privilege is the minimum precaution when working across multiple client environments.
Operational Flow
Provision: Log every access grant in the project's access register in Notion. Include name, role, access level, and date.
Scope: Grant the minimum access needed for the task. If a developer only needs to read logs, give them read-only log access instead of full AWS admin.
Review: Run the access audit checklist at the end of every project before handoff. Revoke access for every team member unless there is a documented reason to keep it.
Offboarding: Revoke access the same day someone leaves a project or the company. Don't wait for the weekend.
Shared accounts: Never share credentials. If a platform only allows one account, talk to the project lead. We will find a workaround.
MFA: Require multi-factor authentication on every account that supports it. If a client system lacks MFA, flag and document it during kickoff.
Audit: Spot-check access registers quarterly to catch permissions drift.
What good looks like
- A developer finishes a client sprint on Friday and removes their own Vercel and GitHub access from the client's organization without being asked.
- The project access register is clean and has no gaps older than two weeks.
- When a vendor asks for admin access to debug, the team gives them read-only access because it is sufficient.
What NOT to do
- Don't grant admin access just because it's faster than configuring specific permissions.
- Don't let offboarding be informal. A Slack message saying 'I'm done' is not access revocation.
- Don't store personal credentials in shared password managers without separate entries per person.
The most common access control failure at agencies is not a sophisticated attack. It is an ex-contractor who still has write access to production because nobody updated the team list. We have seen this. It is embarrassing for everyone and dangerous for the client. The fix is not a better security tool. It is making access revocation a required step in every project transition, as automatic as a final invoice. The access register exists so you cannot forget this step.
Least-privilege access feels slow at first. Granting scoped permissions takes more thought than clicking ‘admin’ and moving on. But doing it right takes ten minutes per access grant. Doing it wrong can cause a 2am incident response and a very uncomfortable call with a client. Scope tightly, log everything, and revoke access on exit. That is the whole job.