Revoking Access

You’re reading an excerpt of The Holloway Guide to Remote Work, a book by Katie Wilde, Juan Pablo Buriticá, and over 50 other contributors. It is the most comprehensive resource on building, managing, and adapting to working with distributed teams. Purchase the book to support the author and the ad-free Holloway reading experience. You get instant digital access, 800 links and references, a library of tools for remote-friendly work, commentary and future updates, and a high-quality PDF download.

Operationally, it’s more complicated to remove access from a set of remote tools than to remove a building fob or pass. To make sure you’re able to remove access to tools and virtual workspaces when someone leaves, it’s best to keep up-to-date records of who has what level of access to which tools. In many startups in particular, new tools are adopted and old ones dropped every month, so this needs to be regularly maintained.

Wherever possible, you can benefit from using single sign-on methods, such as Okta or Auth0. This allows you to remove access to most tools at once. To prevent some difficulty in the event of a dismissal or departure, you may wish to consider early on whether or not a team member needs access to the tool. It’s always good practice to grant the lowest necessary level of access. For example, one would not give out “administrator” access when a lower level of access will do. It’s much easier to grant or change access when it becomes needed, than to reverse the damage done by a disgruntled ex-employee who has administrator access to the key tool. These best practices are even more important in a distributed team, where you need to be able to quickly lock down access to a tangled web of online tools and portals, and this is hard to do in a hurry if you’re disorganized or under-prepared.