A Permission Review After an Agency Staff Member Leaves
Review agency staff access across tool membership, provider roles and application authorization without disrupting unrelated client resources.
TL;DR
- When an agency staff member leaves, review actual access paths before revoking anything: remove the departing person’s unnecessary access while preserving legitimate client operations and business-owned material.
- Map each access path — tool membership, provider roles, application authorization, local material, billing ownership — document owners and approvals, then make changes in a controlled sequence, inspecting state after each action.
- A successful permission review leaves account ownership clear, the departing person’s unnecessary access addressed, and the next operator able to maintain the campaign; assign unresolved items instead of hiding uncertainty.
Review the actual access paths before revoking anything
When an agency staff member leaves, several relationships may need attention: agency workspace membership, client Instagram account access, provider application authorization, and ownership of campaign materials. These are related but separate. Removing one person from a tool should not be assumed to revoke every other form of access.
Start with an authorized access review and a clear client scope. The goal is to remove the departing person’s unnecessary access while preserving legitimate client operations and business-owned material. Avoid broad revocation actions that affect unrelated clients simply because the accounts appear in the same browser session.
Map the person, account, and application separately
For a fictional agency, a staff member maintained reply copy for two client campaigns. One client owner authorized the Instagram connection; the staff member also had separate access to the client’s platform assets. The agency must review both arrangements rather than assuming the automation connection belongs to the departing employee.
Write down which organization owns each account and which authorized person can approve a change. Do not rely on a display name alone when several client identities look similar.
| Access path | Question to answer | Risk of treating it as another path |
|---|---|---|
| Tool membership | Can the departing person still use the workspace? | Assuming provider access ended too |
| Provider account role | Can they still manage the client’s platform assets? | Assuming tool removal changes external roles |
| Application authorization | Which account owner granted the connection? | Revoking a client’s active service unnecessarily |
| Local material | What business content needs a handover? | Deleting useful campaign work with the user |
| Billing ownership | Who manages the subscription? | Leaving payment control with the wrong person |
The table is a review framework, not a claim that DM Now exposes a particular agency-role model.
Related reading: How to Choose Instagram Automation Tools for a Small Team.
Confirm the supported product arrangement
Inspect the current access controls in the actual product and plan. If the workflow does not support the team separation the agency assumed, record that limitation and use an authorized arrangement instead of continuing with shared credentials.
The DM Now automation guide explains the connected reply workflow, but account ownership and staff access must still be checked through the relevant product and provider controls. Do not infer an agency administration feature from a marketing use case.
Use current official interfaces for access changes. Avoid passing passwords or tokens through a handover document, and do not ask the departing person to send a secret so another employee can continue using their identity.
Transfer the campaign knowledge before removing useful context
Identify active flows, current resources, approved copy, unresolved customer questions, and the client contact who can approve factual changes. The business should retain the material it legitimately needs through supported methods.
For the two-client example, each handover should identify the correct destination and owner. A combined folder called “client automations” is not enough if the incoming operator cannot tell which resource belongs to which account.
Do not remove records indiscriminately to make offboarding look complete. Access removal and content retention are separate decisions. Preserve appropriate operational evidence while following the business’s actual information-handling procedures.
Make changes in a controlled sequence
Use the approved plan to change the departing person’s access in each relevant system. After each action, inspect the current state and confirm the intended client scope. Keep a concise completion record rather than relying on memory.
If a connection must be reauthorized, use the correct authorized account owner and review active or pending work before resuming. Reconnection should not trigger an assumption that every old request can be resent. Current eligibility and action state still matter.
Avoid changing all client connections at once unless that is actually necessary and authorized. A narrow confirmed change is easier to verify than a broad action whose side effects are unclear.
Check the remaining operator’s ability to work
After the access review, ask the incoming authorized operator to locate the active campaign, inspect its current destination, and identify the human support route. Use a small controlled eligible test where appropriate.
If optional AI fallback is enabled, transfer responsibility for its account-level facts. DM Now’s AI reply description explains that context and generated output need review. A staff departure can leave stale business instructions even when the technical connection remains healthy.
The test should confirm the specific intended path, not claim that every permission and historical action across the agency has been exhaustively verified.
Leave uncertainty assigned, not hidden
Some access may be controlled by the client or an external administrator. Record the pending action, responsible owner, and current operational effect. Do not mark it complete because a request was sent.
If the agency discovers that a personal account controls a business-critical resource, resolve ownership through the appropriate authorized process. Do not bypass another person’s account or improvise a technical takeover.
A successful permission review leaves each client’s account ownership clear, the departing person’s unnecessary access addressed, and the next operator able to maintain the campaign. It is careful because the access paths differ—not because every staff departure requires dismantling every connected service.