How should teams review agency access in marketing platforms?

How to review agency access without relying on history

Agency access should be treated as time-bound business access, not a permanent relationship. Reviewers need to ask whether the agency is still performing active work, whether that work matches the current contract, and whether the access is still justified by a live campaign or service line. If the business owner cannot defend the entitlement with current need, it should be removed and re-approved only when the need is re-established.

That approach matters because marketing platforms often accumulate access for analytics, publishing, ad operations, creative approvals, and vendor support. Those roles can stay open long after the original engagement changes, especially when campaign ownership moves between teams or agencies. A review that starts from the current operating model is more likely to catch access that has become idle, excessive, or misassigned.

For teams building the review criteria, NHIMG’s Access Reviews and Certification Guide is a useful model for making reviews evidence-based rather than ceremonial. It aligns well with a campaign-led review because the question is not whether access once made sense, but whether it still maps to a present-day business purpose.

What counts as a valid justification in marketing platforms

A valid justification should connect the person or agency to something operationally current and observable. In practice, that means one of three things: an active contract or statement of work, an active campaign or workstream, or a current business owner who can explain why the access remains needed. Vague references to “we have always used them” or “they may need it later” are weak signals and should not survive review on their own.

The platform also matters. Some marketing tools mix content publishing, audience data, ad spend, analytics, and permissions to external agencies. That means the reviewer should test not only whether the account is still needed, but whether the level of access still matches the actual duty. A content agency may need publishing rights, but not billing, audience export, or admin functions. That is why access review and entitlement review need to be paired with a role-level check, not handled as a simple name-by-name list.

NHIMG’s IAM and IGA Basics helps anchor that distinction between access request, entitlement, and ongoing governance. For teams with mixed human and vendor access, the same review logic should be applied consistently to all entitlements, not only staff accounts.

How to make removal the default when ownership is unclear

The safest operating rule is to treat unclear ownership as a reason to remove access, then restore it only after re-approval. That is especially important in agencies because the original requester, day-to-day user, and business sponsor are often different people, and one of them may have changed without the platform record being updated. When no current owner can attest to the need, the entitlement is effectively unactionable, even if it is still technically functioning.

This is where lifecycle discipline matters. Access should be reviewed on a schedule that matches campaign turnover and vendor change, not just annual audit timing. If a platform supports multiple brands or regions, the review should also confirm whether access is tied to one workstream that has ended while another remains active. The review outcome should be explicit: keep, reduce, or remove, with removal being the default for anything that lacks current justification.

NHIMG’s NHI Lifecycle Management Guide is relevant here because lifecycle control is what prevents stale access from becoming accepted normality. For agency access, the practical lesson is the same: if no active purpose can be demonstrated, the entitlement should not persist by inertia.

Practitioner Guidance

What to prioritise: Start with the highest-risk agency entitlements first, especially accounts that can publish, spend, export data, or change configuration. Those permissions create the biggest blast radius if they outlive the business need.

What to verify: Ask for current contract coverage, named business owner, and the specific campaign or service currently supported. If any of those are missing, treat the access as unsubstantiated until proven otherwise.

Common mistake: Teams often review access against the original onboarding record instead of current business reality. That turns recertification into a historical check and leaves dormant agency access in place long after the work has ended.

Practitioner takeaway: The best review decision is usually the simplest one, keep only what can be tied to live work today, and remove everything else until someone explicitly re-justifies it.

Related resources from NHI Mgmt Group

• How should security teams run access reviews for non-human identities?
• How should security teams govern non-human identities that have persistent access?
• How should security teams govern API keys used for generative AI access?
• When should organizations review access controls?