How Much Access Should Employees Have to Business Accounts?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Least privilege means each person, and each tool, gets only the access needed to do their job, and nothing more. Owners get full control. Employees get what their role needs. Contractors get limited access for a set task and time. Artificial intelligence (AI) tools get only the records they need. This limits the damage from mistakes, theft, and hacked accounts.

What this means

The National Institute of Standards and Technology (NIST) describes least privilege as giving each user or process only the minimum access it needs to do its job.

11.7.6 Least privilege

Start with no access, then add only what the job requires. Review it when roles change.

15.2.1 Owner access

Authorized owners get broad admin access to key systems, including the customer relationship management (CRM) system. Keep at least two business-controlled admins (see 8.4.6 Two Business-Controlled Administrators).

15.2.2 Employee access

Employees see only the data and actions their role needs. A scheduler may need customer addresses but not payment history.

15.2.3 Contractor access

Limit contractors by task, time, customer, and system. Give them their own login, set an end date, and remove it when the job is done.

15.2.4 Reviewer access

People who review work, like a bookkeeper checking invoices, get view-only access to the records assigned to them.

23.10.1 Role access

Write down what each job role can access. New hires get the role’s access, not a copy of someone else’s.

23.10.3 Customer data

Only people who need customer information for their work can see it. Sensitive data gets the tightest limits (see 11.6.2 Sensitive Information).

23.10.4 Financial access

Limit access to bank accounts, payment systems, bookkeeping, and financial reports. Split duties so one person can’t both pay a bill and approve it (see 10.6.8 Separation of Duties).

25.4.4 AI user access

Decide who may use AI features in your tools, like AI email drafting in your CRM. Turn them off for roles that don’t need them.

25.4.5 AI data access

Limit which records an AI feature can read. An AI assistant connected to your email or files can see whatever that account can see (see 25.4 AI Permissions and Limits).

Made-up example: Riverbend HVAC has an owner, an office manager, three technicians, and an outside marketing agency. The owner and office manager are GBP owners. The agency is a manager. Technicians can see their own jobs in the scheduling app but not the customer list export. Only the owner can send bank payments. The bookkeeper has view-only access to the bank.

Why it matters

Hacked accounts can only do what their access allows.
Honest mistakes stay small. A helper can’t delete what they can’t reach.
Fraud is harder when no one person controls all the money.
Agencies come and go. If an agency is the only owner of your GBP, a dispute can leave you locked out.

Who this applies to

Any business with more than one person, outside helpers, or tools connected to business accounts. Solo owners should still give vendors and apps the smallest access possible.

How to do it

List the roles in your business and what each one does.
Map each role to the accounts it needs using your access inventory (see 11.7.5 Access Inventory).
Use built-in roles. On GBP, use Business Profile settings, then People and access, to give helpers the manager role unless they truly need owner rights.
Give each person their own login. Shared logins hide who did what and can’t be removed one person at a time.
Set end dates for contractors and calendar a reminder to remove them.
Split money duties so approval and payment are separate.
Review AI settings in each tool and turn off AI features or data connections you don’t need.
Check access on a schedule and after any role change.

What proof to keep

A written role and access chart
Screenshots of user roles in key systems, with names blurred
Contractor access end dates
Dated review notes

Common mistakes

Making everyone an owner or admin because it’s easier.
Shared logins like “office@” used by five people for the bank.
Letting the marketing agency be the only GBP owner.
Never removing contractor access after the job.
Connecting an AI tool to your whole inbox or drive for one small task.

When to get help from a pro

Information technology (IT) specialist: for setting roles across email, files, and your CRM. Bookkeeper or CPA (certified public accountant): for splitting money duties. Questions to ask:

What roles should we set up in our CRM and file storage?
How do we split payment approval and payment sending?
What can our AI features see, and how do we limit it?

Bill’s note

[Bill: add a short note. For example, which Google Business Profile role you ask clients to give SiteSmarty and why, or a case where an agency held the only owner role on a client’s profile.]

If you’d rather have this done for you, SiteSmarty handles Google Business Profile management.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: the roles I set for SiteSmarty accounts, helpers, and tools]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: GBP People and access roles]
[Result so far:]

Questions people ask

Should employees be owners or managers on my Google Business Profile? Usually managers. Google says managers can edit info, respond to reviews, and manage posts, but can’t add or remove users or remove the profile.

How should I limit contractor access? Give them their own login with only the systems and customers they need, and set an end date.

Who should have access to the bank and bookkeeping? The owner, plus only the people whose job needs it. Split approval and payment duties.

How do I limit what AI tools can see? Turn off AI features for roles that don’t need them, and connect AI tools only to the specific folders or records required.

Audit check

Line	Question	Pass looks like	Fail looks like	Evidence to collect
11.7.6 Least privilege	Does each person have only the access their role needs?	Role chart matches actual access	Everyone is admin	Role chart, user lists
15.2.1 Owner access	Do authorized owners, at least two, have admin access?	Two business-controlled admins	One admin, or an outside party as sole admin	Admin list
15.2.2 Employee access	Are employees limited to role-based data and actions?	Role permissions set in CRM	Full access for all	CRM role settings
15.2.3 Contractor access	Are contractors limited by task, time, customer, and system?	Own login, end date, narrow scope	Shared login, no end date	Contractor access list
15.2.4 Reviewer access	Do reviewers have view-only access to assigned records?	View-only roles	Edit or admin rights	Role settings
23.10.1 Role access	Is access defined by role in writing?	Written role chart	No written roles	Role chart
23.10.3 Customer data	Is customer data limited to people who need it?	Restricted folders and CRM views	Open to all	Folder and CRM permissions
23.10.4 Financial access	Is financial access limited and split?	Few users, split approval and payment	One person controls everything	Bank and bookkeeping user lists
25.4.4 AI user access	Are AI features limited to approved users?	AI features on only for approved roles	On for everyone by default	Tool settings
25.4.5 AI data access	Are AI tools limited in what records they can read?	Narrow data connections	AI connected to whole inbox or drive	Connection settings

Where this fits

Do this first: 11.7.5 Access Inventory

Do this next: 11.7.7 Removing Access When People Leave

Sources

National Institute of Standards and Technology, Computer Security Resource Center glossary, "least privilege" (checked October 17, 2026)
Google Business Profile Help, "Manage your Business Profile owners and managers" (checked October 17, 2026)
Federal Trade Commission, "Cybersecurity for Small Business" fact sheets (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.