Delegation and access
How to Give an Assistant Access to Your Inbox and Calendar Safely
Before an assistant starts organizing email or appointments, decide what they need to see and what they may change. The aim is a handoff that makes routine work easier while keeping account ownership, sensitive decisions, and recovery controls with the right person.
In this guide
Write the permission plan before opening the account
Describe the work in concrete terms. Should the assistant label messages, prepare replies for review, send approved routine responses, or manage invitations? Which folders, calendars, clients, or topics are outside scope? A written task description should separate what the account technically permits from what the assistant is authorized to do.
The FTC's Start with Security guide recommends limiting access to information people need for their work. Apply that principle to the handoff: begin with the systems and information needed for the initial responsibilities, then review any request for broader access. An assistant handling scheduling should not automatically receive administrator privileges across your business.
Check what the tool actually allows
Use named accounts, delegated access, or appropriate sharing permissions where the service supports them. Read the product's current documentation and ask your administrator when the available settings are unclear. Do not assume that a feature called sharing, delegation, or collaboration has the same permissions in every product.
In Gmail, for example, a delegate can read, send, and delete email, according to Google's delegation documentation. The scope of that access matters even if your working instructions only authorize sorting messages. If the available permission is broader than you need, consider a narrower workflow, such as reviewing drafts or forwarding selected tasks through an approved system.
This guide describes a planning approach rather than a click by click setup for every email service. Account type, administrator settings, and product changes can affect the options available to you.
Keep account protection and recovery with the owner
Use unique passwords and enable multifactor authentication where available. CISA's Secure Our World guidance explains the role of strong passwords, password managers, and multifactor authentication in protecting accounts. Use an approved password manager when a credential must be shared; avoid putting passwords into an ordinary email, task comment, or discovery call form.
Keep recovery methods and primary ownership under the business owner's or administrator's control. Decide what the assistant should do if a login prompt, suspicious message, or unexpected permission request appears. The answer should be to stop and contact the designated owner through a known channel, rather than improvising a workaround.
Create a small decision table
| Example situation | Agreed routine action | Owner decision |
|---|---|---|
| Standard appointment request | Offer approved openings using the template | Exceptions to the agreed schedule |
| Routine client question | Prepare or send an approved response within scope | Pricing, complaints, or commitments outside the template |
| Invoice or payment request | Flag and route to the designated owner | Payment approval or a change of bank details |
| Private or sensitive message | Follow the agreed restricted handling rule | Whether access or a response is appropriate |
Adapt the table to your work. The examples are not a complete security policy. The useful feature is that both people know where routine handling ends and an approval begins.
Test the handoff with ordinary, limited work
Start with a small batch of messages or a short scheduling period. Explain the naming conventions, what counts as urgent, and how a completed task should be recorded. Review a few results together before widening the assignment.
Use a simple exception list: the message, the issue, the proposed action, and the decision needed. Keep private information out of unnecessary screenshots or training examples. When a repeated question reveals a missing instruction, update the process so the next task is easier to handle consistently.
Plan the end of access at the beginning
- Keep an inventory of the accounts and permissions granted for the assignment.
- Name the person responsible for changing or removing each permission.
- Review access when responsibilities change, not only when someone leaves.
- At the end of an assignment, remove delegation and sharing permissions that are no longer needed.
- Confirm the return or agreed deletion of work files and the handover of outstanding tasks.
- Review any shared credentials, active sessions, and device access with your administrator as appropriate.
At Lazar & Company, access and responsibilities are agreed before work begins. Bring your tools and proposed tasks to the discovery conversation; do not send credentials with an initial inquiry. Our first month guide explains how scope, kickoff, and early review fit together.