Establish who controls the profile
Keep the owner role with your business and invite the content team through Google Business Profile's own access controls. Manager access can support day-to-day profile work without sharing a password, but it is broader than permission to publish posts. Agree on the work, check the invitation and record how access will end.
Before sending an invitation, open the profile for the exact business location and check who can manage its users. If nobody inside your business can do that, resolve ownership first. Adding another person does not resolve an existing ownership problem.
As checked in October 2026, owners control users and the profile. Managers can edit information, posts and review replies, but cannot add or remove users or remove the profile. Each user has their own Google Account. Google's owner and manager guide explains the current roles.
Do not treat “Manager” as a posts-only permission. Before inviting someone, decide which edits your business authorizes and which must come back to you. The ability to make a change does not mean the change is in the provider's service scope.
For several locations, list the relevant profiles separately. Access to the right business name at the wrong address still creates the wrong handoff.
Confirm the invitation before sending it
Ask the provider for the Google Account address to invite through your normal project conversation. Confirm it there before entering it; do not infer the account from a person's display name or a forwarded screenshot. This is a preparation recommendation, not a request to send credentials.
Google's current invitation path is More → Business Profile settings → People and access → Add. Enter the account address, choose Manager and send the invitation. Check the accepted role afterward. Follow the current Google instructions if the interface differs.
Keep passwords, verification codes, backup codes and recovery details out of the brief, shared content calendar and approval folder. Account access and a filming brief solve different problems.
Ask each person with access to protect their own login. Google's 2-Step Verification help explains an additional account-security layer and notes that work-account setup may depend on the administrator. Record that the security check is complete; do not collect the person's codes.
Separate permissions from responsibilities
Use a short scope card before anyone starts editing. Three useful boundaries are:
- Content: which approved posts or images the provider may publish.
- Business facts: who approves changes to hours, services, contact details and destinations.
- Customer responses: which replies belong to the provider and which need someone inside the business.
Review management, correcting the profile, resolving suspensions and running advertising are separate tasks to discuss. A platform role does not automatically add them to a content agreement.
For the broader division between creating files and running the account, use content creation versus social media management. This checklist focuses on the access needed to carry out the agreed work.
Make the plan practical.
Keep your answers and unresolved questions together before the project conversation.
Use the worksheetCopy this access handoff checklist
Keep this record in your private business workspace. Use roles in the shareable version and confirm account addresses privately.
Scroll horizontally to see the full table.
| Check | Business decision or evidence | Responsible role | Status |
|---|---|---|---|
| Correct profile | Business name and location checked | Business owner | Pending / checked |
| Owner remains inside the business | Owner can open People and access | Business owner | Pending / checked |
| Recipient confirmed | Account address confirmed through the project conversation | Project lead | Pending / checked |
| Role selected | Manager, with agreed duties recorded separately | Business owner | Pending / checked |
| Invitation accepted | Recipient appears with the expected role | Business owner | Pending / checked |
| Authorized work | Posts, images and any approved profile changes listed | Approver | Pending / checked |
| Restricted changes | Contact details, hours and other business decisions assigned | Approver | Pending / checked |
| Login protection | Each user checks their own security settings | Each user | Pending / checked |
| Exit responsibility | Person who can remove access is known | Business owner | Pending / checked |
Before marking the handoff complete, confirm the intended person can reach the intended profile. Do not publish a test post merely to prove access; check the role and agree what actual work may begin.
Make the exit as clear as the invitation
When staff or providers change, review users, pending invitations and responsibility assignments. Remove obsolete access through the profile's own controls rather than changing a shared password that should never have been shared.
An owner removes users through People and access. Past profile actions remain after access ends. Google's removal instructions cover the distinction.
Separately check any approved content still scheduled, files the business needs and destinations attached to posts. Ask the outgoing provider what remains pending. These are handoff questions, not a promise that every scheduling tool behaves the same way.
Continue with the monthly content guides and how to assess inquiries beyond likes.
How we can help
With social media management, your accounts stay yours and we use partner or manager access rather than passwords. Three platforms are included: Instagram, Facebook and Google Business Profile by default; TikTok can replace one, and a fourth platform is a paid extra scoped on the call. Content only leaves publishing and replies with your team.