Four principles
- Own login, not yours. Use the delegation features in your email, calendar and documents so the assistant signs in as themselves. Actions are logged under their name, and you never share your main password.
- Least privilege. Grant the narrowest permission that covers the task. Read-only beats edit; edit beats admin.
- Shared through a password manager. Where a tool has no delegation feature, share that one login through a business password manager, never by email, chat or spreadsheet.
- Easy to revoke. Keep a written list of every access granted, so offboarding takes minutes.
Email and calendar delegation
Google Workspace and Gmail let you add a delegate who can read, send and organise mail in your mailbox while signed in to their own account. Calendar sharing is set separately. Microsoft 365 offers mailbox and calendar delegation in Outlook, with distinct permissions for reading mail, sending on behalf of you (the recipient sees both names) and sending as you. Pick the option that matches how you want replies to look, and don't grant more than that.
Sharing logins with a password manager
For tools with no delegation option (airline accounts, some vendor portals, subscription services), business password managers let you share individual items or a dedicated shared folder or vault with the assistant. Ask for these settings:
- A separate shared vault for assistant work, so nothing else is visible
- Item-level sharing, with the option to hide the password while still allowing auto-fill where the manager supports it
- Activity logs, so you can see what was accessed
- Access removal that takes effect immediately when the engagement ends
Keep banking, payroll admin, tax portals and your password manager's own master account out of shared vaults unless there is a specific, written reason.
Two-factor sign-in
Every account the assistant uses should have two-factor sign-in on the assistant's own device or authenticator. Avoid setups where the assistant has to ask you for a code each time: it trains both of you to read codes out over chat, which is exactly what phishing relies on. Never share a code you didn't request yourself.
What an assistant should not do
Money
Approve payments, move funds, change payee or bank details, or use a company card beyond an agreed limit and purpose.
Commitments
Sign contracts, accept terms, or agree prices or deadlines on your behalf, unless a written rule covers that exact case.
Speaking as you
Write as you on HR, legal, investor, press or personal matters without your explicit review.
Data handling
Forward company data to personal accounts, store passwords in notes or documents, or paste confidential content into outside tools (including AI tools) without your permission.
Security settings
Change your passwords, recovery email, recovery phone or two-factor methods, or add new delegates.
Unverified requests
Act on urgent requests for payments, gift cards or credentials that arrive by email or text, even if they look like they come from you. Confirm through a second channel first.
Offboarding checklist
- Remove mail and calendar delegation and document sharing
- Remove the assistant from shared password-manager vaults, then change passwords for any shared logins
- Revoke any app passwords, connected apps or sessions created for the work
- Remove the assistant from team chat, project tools and shared drives
- Collect any notes, playbooks or task lists into your own storage
For broader guidance on account security, the US Cybersecurity and Infrastructure Security Agency publishes plain-language advice on securing accounts.
Questions to ask a provider
What devices will the assistant work on?
Ask whether work happens on a dedicated, updated device with disk encryption and a screen lock, and whether the provider has a written policy for this.
Will the same person work on my account each day?
Ask who has access, how cover works during holidays, and whether a backup person needs separate access.
Will you sign our confidentiality agreement?
Ask before sharing anything. Most providers expect to sign an NDA and agree confidentiality terms in the service contract.
Want this handled for you? Tell us what fills your inbox and calendar, and a service partner will reply with a proposed scope.
Request a proposal