With invitation-based access and limited roles, never shared passwords: each agency, freelancer, agent or branch works from approved assets and can only do what its role allows. And with a rule few organizations follow: domains, links, QR codes and accounts stay in the institution's name, so switching agencies doesn't mean losing what's already printed or published.
Most brand problems with third parties don't show up while the relationship works. They show up the day it ends.
Why is third-party access the weak spot in brand governance?
Because it gets set up in a hurry and nobody revisits it:
- Passwords shared by email or text that keep working months after the person left the project.
- Accounts in the agency's name: the social page, the ad account, the analytics.
- Links and QR codes built with the agency's tools, on domains the institution doesn't control.
- Nobody removes access when the contract ends, because nobody has the list.
What access does each third party need?
Not everyone needs the same thing:
| Who | What they need | What they don't need |
|---|---|---|
| Creative or digital agency | Edit pieces and pages with approved assets and themes | Export lists, share to other workspaces, manage users |
| Freelancer | Access to one project, with an end date | Access to the whole workspace |
| Branch or independent agent | Approved templates and the QR codes for their location | Editing the logo, colors or legal disclosures |
| Company in the same group | Its own workspace, with group assets read-only | Seeing other companies' data |
| AI assistant | The permissions of the person who connects it, nothing more | Admin permissions |
The underlying rule: the minimum access, for the minimum time.
Who should own the assets?
The institution, always. The agency works inside; it doesn't own:
| Asset | Why it matters |
|---|---|
| Domains | Without the domain, links and pages stop working |
| Short links and QR codes | What's printed in branches and on packaging depends on them |
| Ad and social accounts | The history, audiences and billing belong to the institution |
| Analytics | Your customers' data shouldn't stay with a vendor |
| Source files | Without them, the next agency starts from zero |
| Campaign pages and sites | What's published has to be able to stay published |
Who's responsible for what the agency publishes?
Your organization. Advertising rules apply to the institution whose ads they are, whoever drafted them. Texas puts it plainly for insurers: 28 Tex. Admin. Code 21.122 requires a system of control over advertising, requires agents to submit their own ads to the home office for approval, and says no insurer may avoid responsibility by having someone else prepare or approve its ads.
Two more angles worth checking with compliance:
- Banks: if the agency also runs technology for you, such as the website or a digital platform, it falls under your third-party risk program (OCC Bulletin 2023-17), from due diligence to termination.
- Health organizations: if the agency handles patient information, for example lists for a campaign, it's acting as a business associate, and HIPAA requires a written business associate agreement before PHI changes hands.
What do you do when an agency relationship ends?
A list worth writing into the contract on day one:
- Remove access the same day, to every tool, not just the main one.
- Confirm ownership of domains, links, QR codes, ad accounts, social pages and analytics.
- Get the source files for everything produced under the contract.
- Rotate any credentials that were ever shared, even "just once."
- Review what's still live: expired campaigns, test pages, links pointing to old destinations.
- Update the destinations of printed QR codes if they pointed to anything of the agency's.
- Document the offboarding, with a date and an owner.
An honest caveat: the best time to negotiate the exit is at signing, not at the end. An agency that resists keeping assets in your name from the start is telling you something.
How does linkable.id handle it?
In linkable.id, our brand governance platform, third-party access works like this, per its workspace and role governance:
- Accounts by email invitation. Each person sets their own password; nobody sends one.
- Roles defined by a superadmin. Sharing to other workspaces, creating share links, exporting lists, exporting QR codes, assigning roles and viewing billing are separate permissions, and read-only roles can't change anything.
- Mandatory two-factor authentication, if your admin turns it on.
- History under every page, showing who changed what and when.
- Your domains and your QR codes. Every link lives on a domain your institution connects, each QR code always points to its short link, and a domain can't be deleted while links or pages depend on it. If you switch agencies, printed QR codes keep working.
- Assets shared read-only with your agency or other group companies, through the Brand Vault.
Do you know what access your agency has today?
If answering means asking the agency, that's the first fix. See how linkable.id works and let's review who has access to what. For the foundation, read why nobody follows the brand guidelines.
Sources
- 28 Tex. Admin. Code 21.122, Advertising by insurers (Cornell LII): https://www.law.cornell.edu/regulations/texas/28-Tex-Admin-Code-SS-21-122
- OCC Bulletin 2023-17, Third-Party Relationships: Interagency Guidance on Risk Management: https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html
- 45 CFR 164.502, Uses and disclosures of protected health information (Cornell LII): https://www.law.cornell.edu/cfr/text/45/164.502