Audit access quarterly
Google Ads, Merchant Center, Analytics, Shopify. Former agencies, former staff, freelancers from two years ago — they are usually all still there.
Never share logins
Individual access, revoked individually. A shared password cannot be revoked without disrupting everyone.
Billing is the real exposure
Anyone with billing access can change where invoices go. That should be a very short list.
When an agency leaves
Revoke manager access after handover is complete, not before — and confirm it actually happened rather than assuming.