Set up access for a remote assistant: a least-privilege checklist
Short answer: Give a remote assistant only the access that their tasks need. Use a password manager, not shared passwords. Turn on a second sign-in step. Use a separate access list for each client. Review the list every month and remove what the assistant no longer uses.
Who this is for
This guide is for business owners who hire a remote assistant and for agency leaders who manage staff across client accounts. It covers access setup. It is not legal or security-certification advice. For regulated data, ask a qualified security or legal adviser.
Why access needs a plan
An assistant often needs email, a calendar, a file drive, and a billing tool. If you share your main login, you lose control. You cannot see who did what. You cannot remove one person without changing everything.
The US Cybersecurity and Infrastructure Security Agency (CISA) gives simple password rules. Use passwords of at least 16 characters. Make each one random and unique. Use a password manager. Add multifactor authentication (MFA), which asks for a second proof such as an app code. CISA states that MFA makes accounts considerably safer than passwords alone. The page shows no date, so check it for updates.
The idea of “least privilege” is a common security principle. It means each person gets the smallest set of access that they need. This guide applies the idea in a simple way. The checklist below is Orbytt’s own design.
The access setup checklist
| Step | What to do | Owner |
|---|---|---|
| 1. List the tasks | Write the five to ten tasks the assistant will do. Note the tool for each. | Owner |
| 2. Map tasks to access | For each tool, choose the lowest role that works: view, comment, edit. Give admin rights only when a task needs them. | Owner |
| 3. Use a password manager | Share logins only through the manager. Never send a password in chat or email. | Owner and assistant |
| 4. Turn on MFA | Turn it on for the assistant’s accounts and for shared tools. Do not share MFA codes by text or chat. | Assistant, owner checks |
| 5. Use named accounts | Give the assistant their own login where the tool allows it. This shows who did what. | Owner |
| 6. Agree on AI tools | List which AI tools the assistant may use and what data may enter them. | Owner |
| 7. Review monthly | Check the access list. Remove unused access. Record the date. | Owner |
| 8. Plan the exit | Write the steps to remove all access on the last day. | Owner |
Example (hypothetical)
This example is not a real case. An agency serves three clients. Each client has its own folder, its own shared inbox, and its own password-manager group. A new assistant joins to support Client A and Client B.
- The lead adds the assistant to the Client A group and the Client B group. Client C stays closed.
- The assistant gets “edit” on the Client A folder, and “view” on the Client B reports.
- The lead writes: “No Client B data goes into AI tools until Client B approves.”
- At the 30-day review, the lead removes a billing tool login that the assistant never used.
If the assistant leaves, the lead removes two groups. Nothing else changes.
What can go wrong
- Too little access slows work. The assistant waits for approvals. Fix this with a fast reply rule, such as “answer access requests within one working day”.
- Too much trust at the start. Starting small is easier than taking access away later.
- Shared accounts remain. Some tools allow only one login. Use the password manager’s sharing feature and keep a log of who used it.
- Time zones. If you are in the US and the assistant is in the Philippines, access requests can sit overnight. Set a standing approval for routine tasks.
- Management effort. Access reviews take time. Put them on the calendar.
- Client rules differ. Some clients forbid AI tools or offshore access. Agencies should confirm client approval before they add an assistant or an AI tool.
Start here and extend
Start here: Do steps 1 to 4 before day one.
Advanced extension: Move to single sign-on, where your tools allow it. CISA names this as a next step when a business grows. Add a written client-approval record for each AI tool.
Pair this with the 30-day onboarding plan. Add an access check on day one and day 30.
Common questions
Is a password manager worth the cost?
For most teams, yes. It replaces shared notes and chat messages that hold passwords. Compare current prices on the vendor’s pricing page before you buy. Prices change often.
What if the tool has no role setting?
Then do not put sensitive data in it, or accept the risk with open eyes. You can also ask the vendor about team roles. Some tools hide this setting in a higher plan.
How do I check what an assistant did?
Use named accounts and the activity log that many tools offer. Tell the assistant that you review logs only to protect the business and clients. Open communication builds trust.
What about data privacy law?
Rules differ by country and by data type. If the work involves personal data, ask a qualified adviser what applies to you and your assistant. This guide does not cover legal duties.
Do this week
List every tool your assistant uses. Next to each, write the lowest role that fits. Change one login from shared to named.
Sources
- Require strong passwords. Cybersecurity and Infrastructure Security Agency (CISA). No publication date shown on the page; read October 19, 2026.
