Practical software guides
A freight partner may need shipment documents without needing administrator access to the whole customer system. Record the system permission separately from permission to share a particular document.
| System | Partner access | Expiry/test |
|---|---|---|
| Shipment portal | Named broker account; assigned jobs only | End of contract; try an old shipment link |
| Document folder | Read selected customs documents | Remove group membership and test a direct link |
| Accounting | No partner login; approved export only | Verify scheduled exports stop |
| API integration | Scoped service credential | Revoke and confirm requests fail |
Offboard more than the login
- Disable named accounts and active sessions.
- Remove group memberships, shared links and delegated inbox access.
- Rotate a shared credential if individual revocation is impossible.
- Stop scheduled exports and revoke API keys.
- Have a second authorised tester confirm that access fails and legitimate internal work still succeeds.
Use MFA where supported and avoid shared accounts when named accounts are available. Do not put passwords or tokens in the register. OWASP authorisation guidance explains least privilege and access checks. See request verification and provider exit testing for the adjacent questions.