The twenty minutes that protect the account
Almost no workspace is lost to a clever attack. They are lost to a shared password and a laptop nobody asked about.
Security in a workspace is mostly administration, not cryptography. Four decisions cover nearly everything that actually goes wrong.
Two admins, not one and not seven
One admin is a single point of failure with a holiday and a phone that can be lost. Seven admins means nobody is responsible, because responsibility does not divide.
Two is the number: one primary, one who can act when the first is unreachable. Everyone else gets the access their work needs. If you find yourself making someone an admin so they can do one specific thing, that is a signal the permission should exist separately, not that they should hold every permission.
Never share a login
The shared account always starts reasonably — one licence, a tool two people use occasionally. Then it is in a password manager, then in a message thread, and then it belongs to someone who left last year.
Two things break with a shared login and neither is recoverable afterwards. You cannot tell who did something, so any question about a change ends in a shrug. And you cannot remove one person's access, because there is only one door and everyone has the same key.
Look at the device list twice a year
People change laptops and phones more often than they think, and the old ones stay signed in for as long as nothing forces them out. That is where the quiet risk lives: not a break-in, but a device in a drawer, or sold, still holding a session.
Open the active sessions, and sign out anything you do not recognise or no longer use. It takes five minutes and it is the only routine security task that regularly finds something.
The day someone leaves
Do the access removal on their last day, not in the week after. Not because you distrust the person — usually you do not — but because the task competes with everything else once the urgency is gone, and access that survives a departure tends to survive for years.
Three things in order: remove them from the workspace, transfer ownership of anything they own alone, then check whether any shared credential needs changing. The second one is the step teams forget, and the file nobody can access afterwards is always discovered at the worst possible moment.
Questions people actually ask
How many admins should a workspace have?
Two — one primary and one who can act when the first is unreachable. One is a single point of failure; several means nobody is responsible, because responsibility does not divide.
Why not use one shared login for a tool?
Because two things break permanently. You cannot tell who did something, so any question about a change ends in a shrug, and you cannot remove one person's access — there is one door and everyone holds the same key.
What should happen when someone leaves?
On their last day: remove them from the workspace, transfer ownership of anything only they own, then change any shared credential. The transfer is the forgotten step, and the orphaned file is always found at the worst moment.
