Skip to content

No passwords, ever: how a trustworthy AI partner gets access

Diagram showing four secure access methods to a resource vault: OAuth/SSO with an active session timer, API keys with a revocation button, a dedicated service account, and a shared password marked as not recommended.

Bringing in an AI partner means giving someone access to your business. That is the part that should make you a little nervous, and it is the part most people never ask about.

Here is a simple filter. If a vendor asks you to hand over your passwords, that is the warning sign. There is a safer way to do this, and the good ones already work that way.

Series: Trusting your AI partner — Part 1 of 3. How a partner gets access · How it fails safely · How you leave clean

The password red flag

Shared passwords are the single most common security hole in a small business. They cannot be traced to a person, they cannot be revoked without locking everyone out, and they tend to live in inboxes and sticky notes forever.

A partner who asks for one is telling you they do not have a better system. You want the opposite.

How safe access actually works

Good access is invite-based and least-privilege. You invite the partner into a specific tool with a specific role, granting only what the job needs and nothing more. You can see exactly who has access, and you can remove it in one click without disrupting anyone else.

Every identity should have multi-factor authentication turned on. And the account used to run automations should be separate from the account someone uses to administer your systems. If one is ever compromised, the blast radius stays small.

Where the secrets live

Automations need keys and tokens to connect your tools. Those belong in a dedicated secrets vault, encrypted and rotated on a schedule, never pasted into a chat, a document, or the automation's own code. A partner who stores secrets in plain text is one screenshot away from a bad day.

Your five-minute check

Open the admin panel of the tools that matter most and answer three questions. Who has a login they no longer need? Is multi-factor authentication on for everyone? Are any accounts shared? Fixing those three things this week closes the doors most small businesses leave open.

Keep exploring

This is Part 1 of Trusting your AI partner. Next up: what happens when your automation breaks. If you want a clear read on your current access and guardrails, start the AI Readiness Audit or contact FIT.