Ad Account Access Governance for Creator Programmes

Your Business Manager stays yours, your TikTok Business Center stays yours, and we hold partner access by Business ID with the tasks the work requires and nothing above them. In the last four creator programmes we inherited, between a fifth and a third of standing ad-account access belonged to people who had left the payroll or the roster. In one, a freelance editor still held the advertise task on an account carrying a seven-figure annual budget. The rule we do not bend: No shared logins. Not a creator's, not yours, not ours. When a creator offers a password to make whitelisting easier, we decline and set the permission up properly, which costs a day and removes a whole class of problem. When a client sends credentials, we ask for them to be rotated. This is not a line kept quietly in a policy document. It is the reason several of these engagements open with an argument. What gets built: One owning business per advertiser, verified, holding the platform's written gambling and gaming permission per jurisdiction where that applies. Two named admins on the client side, both internal, neither of them us. Agencies, contractors and creators attached as partners with task-level access, advertise and analyse, almost never manage. Pixels, datasets and conversion API tokens owned by the advertiser and rotated on a schedule that survives a supplier change. Two-factor enforced across the business rather than requested politely and tracked in a spreadsheet. The review: Each quarter, everyone holding standing access is re-justified in writing by whoever sponsored them, or removed. The default is removal. We produce the list, you approve the deletions, and the deletions happen that week rather than joining a backlog that gets cleared during the next incident. Exit: On the last day of any relationship, ours or a creator's or another agency's, the revocation list goes out and removal is confirmed in writing. Access left standing after a relationship ends is a breach with a date attached, not an administrative loose end, and it is the single most common thing we find when we open an account for the first time. Regulated categories: Gambling accounts are breached through access mistakes more often than creative ones. An operator with permission for one jurisdiction running through a business unit that also serves an unlicensed one. A creator authorisation sitting in an agency's Business Center, outside the licensee's control, while the licensing conditions require the licensee to remain in control of its own marketing. The access map is part of demonstrating that, and we write it so a compliance officer can read it without an interpreter. Not included: Campaign management, creative, creator contracts. We do not take ownership of client assets. We will not be the sole admin on an account we do not own. We will not accept an arrangement where an agency's business holds the brand's audiences or datasets. If your current agency has that arrangement, unwinding it sits inside this engagement and it usually occupies the first three weeks. Who this is wrong for: Organisations with nobody internal willing to hold admin. Somebody on your side has to be accountable for access, and where that person does not exist, everything we build decays within two quarters and you will have bought a document. Also wrong if you want the access map as the whole deliverable. The map is the easy half. The removals are the half that people resist.