The first week with a new agency or fractional marketer usually starts with an email titled something like "Access needed". It lists your analytics, your ad accounts, your website, your CRM, and sometimes your domain. It's tempting to grant admin access to everything because it's quicker than figuring out what each role does, and there's a product to ship.
That's usually fine. The risk in marketing agency onboarding is rarely what you share. It's who owns the account when the engagement ends.
The rule: grant access, keep ownership
Every system your marketing touches should live in an account your company owns, under a company email, with your partner added as a user. Not an account they set up for you "to save time". Access can be removed in a minute. Ownership becomes a negotiation.
The one that catches founders: Google Ads
Google Ads is where this matters most because of how manager accounts work. Google's help page is explicit: if a manager account links to an existing account, "it won't have ownership of that newly linked client account by default." If the manager creates a new account, "the manager will automatically become the owner of that account" (sourced from Google Ads Help).
So the safe order is simple. Create the Google Ads account yourself using a company login and company billing. Then accept your partner's link request. The same page notes that the client account still owns its data and can remove an owner's access by unlinking, which is exactly the position you want to be in.
The handover list, with the right access level
Google Analytics. Of the GA4 roles, only Administrator can manage users; Editor has full control over property settings but can't add or remove people (sourced from Google Analytics Help). Give your partner the Editor role, or the Marketer role if they only need audiences and events. Keep Administrator with two people inside your company.
Search Console. There are verified owners, who proved ownership with a token, and delegated owners, who were granted it. If every verified owner is removed, everyone else will lose access after a grace period (sourced from Search Console Help). Keep the verification on your own domain, under your own account, and add your partner as a full user.
Ad accounts. Google, LinkedIn and Meta, each created by you, billed to your company card, with your partner linked in. Ad spend should never run through someone else's account.
Domain registrar and DNS. Don't hand over the registrar login. When your partner needs a DNS record for site verification or email authentication, they send it to you, and you add it.
Website or CMS. An editor or publisher role, not the owner seat. If the marketing site lives in your product repo, changes come in as pull requests your team reviews.
CRM. A user seat, not super admin. If your partner sends an email from it, the consent records remain in your CRM. Under Canada's Anti-Spam Legislation (CASL), every commercial email requires consent, clear sender identification, and a working unsubscribe mechanism, and the onus of proving consent falls on whoever claims it (sourced from the CRTC). Your CRM also holds customers' personal information, so PIPEDA applies to how that information is shared. This is general guidance, not legal advice; talk to counsel for anything consequential. If the CRM is still on your list, here's where to start with CRM and lifecycle email.
What to hand over that isn't a login
The logins take an afternoon. The context is what decides whether the first month is useful:
Your positioning document, even if it's a rough page of notes.
Recordings or notes from customer interviews and sales calls.
Why your last ten deals were won or lost, a sentence each.
Why customers churn, in their words, if you have them.
What you've already tried in marketing, and what happened.
That's why the first weeks of how I run an engagement are read access and a written diagnosis, before anything ships. A partner who starts producing content in week one is producing it without this context.
Keep a one-page access register
Before the first login goes out, start a shared document listing every system, who has access to it, at what level, and the date it was granted. It takes ten minutes. It also makes the end of an engagement painless: the founder's checklist for leaving an agency starts from exactly this list.
If your marketing partner left tomorrow, which of these would you still own?