Access provisioning

How it works

Use a checklist: email, Slack, password manager, CRM, bank-read tools, customer inbox. Least privilege. DPA cares who can see personal data. Offboarding is the same list in reverse, before you argue about quitclaims. For a U.S. company hiring one Filipino teammate, write this into the brief, the employment contract, and the peso payroll file before the start date. Slack habits do not override the Labor Code, BIR, or NPC. If the local employer of record holds the paper, they run the statutory step; you still owe a clean operating definition so the seat does not fail in week three. Put a number on the example when you budget loaded cost, because a nameless allowance always returns as a December surprise or a missed SLA.

Example: last day 3 p.m. PHT: inbox ownership transferred, password rotated, laptop shipped. Not ‘we’ll do it next sprint.’

How it differs

Inbox access protocol is the customer-mail subset. Company device vs BYOD changes how hard revocation is.

Common errors

Shared passwords in a Google Sheet titled Passwords.

In practice

Treat Access provisioning as a week-one operating object. Put this on the scorecard or the start-date checklist. If it only appears in a pitch deck, it will not survive week one. Write an owner - founder, local employer, or worker - and a date you will look at it again: first cutoff, first holiday, or first miss. If nobody can show a contract clause, a payslip line, a calendar block, or a checklist box, you do not have access provisioning yet. You have a conversation. Convert the conversation before the person starts, while changing the deal still costs a paragraph rather than a resignation. Re-read the worked example above against the actual hire in front of you. If the numbers in that example cannot be swapped for this seat’s pesos, hours, and start date, the brief is still unfinished.