A plan before access
Start by identifying what information the project involves, where it currently lives, and who is authorized to use it. Confidentiality requirements, approved services, and any restrictions on copying or sharing belong in the project scope.
Only the access the work needs
The preferred approach is to work within client-owned systems using named accounts and limited permissions. Where copies are necessary, their purpose, storage location, and access should be agreed in advance. Account access, multifactor authentication, and secure credential exchange are part of that discussion—not something to handle through an inquiry form.
Deliberate use of automation and AI
Before introducing a connected service or AI-assisted workflow, identify what information it will receive, the provider’s data practices, and where human review is needed. Confidential information should not be entered into a new tool simply because the tool is available.
A clear finish to the project
Agree on what will be handed back, which permissions will be removed, and whether any working copies need to be retained or deleted. Retention periods and handling requirements depend on the engagement and belong in its written agreement.