Agree the purpose and approval boundaries
Write down the locations included, recurring work, sensitive facts, review-response rules and authorised approvers. The access level should support that scope without becoming broader than necessary.
Review and remove access deliberately
Maintain an access register and review it after staff or agency changes. At termination, stop scheduled work, preserve the client-owned profile and remove delegated agency access through the provider controls.
Last reviewed: 16 August 2026. Provider features and policies can change; confirm current account controls before acting.