Client Credential Intake and Access Baseline (Onboarding)
A checklist with 7 steps: Inventory every credential and identity the client is handing over before work starts.
By InnovaAI ResearchPublished
What are the steps?
Client Credential Intake and Access Baseline (Onboarding)
- 01
Inventory every credential and identity the client is handing over before work starts
List shared logins, admin accounts, API keys, service accounts, and any AI agent tokens that touch client systems. A retainer that begins with an unknown credential count is a retainer you cannot audit later.
- 02
Separate human logins from non-human secrets in the intake sheet
Employee passwords, machine tokens, and agent credentials fail differently and need different controls. Tag each entry as human, machine, or agent so the vault structure matches the risk profile.
- 03
Confirm which identity provider the client already runs before recommending anything
If the client is on Okta or Entra ID, the agency should federate rather than duplicate. Standing up a parallel directory for a 3-person account is overhead the client will not renew.
- 04
Issue agency staff individual accounts, never shared logins
Shared credentials break attribution the moment something goes wrong, and they make offboarding a guess. Where a vendor forces a shared seat, record who holds it and rotate on any team change.
- 05
Set a vault boundary for client secrets and document who can open it
A dedicated vault per client, with named access and an owner, keeps one client's keys out of another client's blast radius. Bitwarden's self-hosted option or a 1Password vault both satisfy this; the choice matters less than the boundary.
- 06
Require MFA on every account that supports it and log the exceptions
Track accounts where MFA is unavailable or blocked by the client, with a named owner and a review date. Unlogged exceptions become permanent gaps.
- 07
Run a first-week access review and hand the client a written baseline
Deliver a one-page record of every identity, its owner, its access level, and its MFA status. This document is the reference point for every later audit and offboarding.