AgencyFacebook Ad Account Access and Security Checklist
An account handover should explain who has access, what each person can do and how that access will be removed when the work ends.
Map responsibilities before granting access
List the people who manage campaigns, approve content, handle billing and review reports. Connect each responsibility to the access required for that task. Ask the account owner or service team to explain unfamiliar permission requests. Keep an agreed record of who can approve new access and changes to the arrangement.
Use individual access where available
When the platform supports individual permissions, grant access to each person rather than circulating one shared login. Provide the permissions needed for the assigned work and review them when responsibilities change. Before accepting an invitation, check the expected asset and sender through a contact method you already trust.
Protect authentication information
- Use a unique password for each account.
- Enable an available two-factor authentication method.
- Keep recovery information under the account owner's control.
- Do not publish passwords, recovery codes or TOTP secret keys.
- Avoid putting authentication details in shared campaign documents.
A TOTP secret key can generate future verification codes. Treat it as a credential rather than a contact detail. A current code is also sensitive while valid. If a secret may have been exposed, use the account's security settings and official recovery guidance to replace the affected authentication setup.
Document the handover
Record the assets involved, granted permissions, billing responsibilities and support contact. Agree on how to report unexpected changes or loss of access. Keep this operational record separate from passwords and recovery information. Confirm how access and any remaining funds will be handled when the service ends.
Review access when the team changes
Check permissions when someone leaves, changes role or completes a temporary assignment. Remove access that is no longer required and confirm who remains responsible. Review the platform's current security options with the account owner. Before onboarding with AgencyCrowns, ask the team to confirm the access model and responsibilities that apply to your proposed service.