When a Client Relationship Ends: A Checklist for Revoking Document Access

No matter how a client engagement ends — successfully completed, contract concluded, or relationship wound down — the document access revocation process should be the same. Here's the checklist that ensures it actually happens.

Why a Checklist?

The engagement close process happens under pressure. You're either celebrating a successful project, wrapping up final deliverables, or managing the transition out of a relationship. Document access revocation isn't top of mind.

A checklist makes it impossible to skip. It's a non-optional final step, not something you do "when there's time."

---

The Five-Step Document Close Checklist

Step 1: Inventory All Shared Access

Before you can revoke anything, you need to know what you've shared. For the engagement being closed:

• List all Google Drive files and folders shared with this client (check sharing settings on each)
• List all email attachments sent to the client that contain deliverables (these can't be recalled, but note them)
• List any other sharing methods used (Dropbox links, Notion pages, Figma files, etc.)
• Identify any documents in "anyone with the link" mode that should be restricted

Step 2: Classify Retention Requirements

Not all access needs to be fully revoked. Classify each item:

• Keep as view-only archive: Deliverables the client should retain reference access to (standard for completed engagements)
• Revoke entirely: Anything the client no longer has a legitimate need to access
• Was never shareable (verify): Proprietary frameworks, internal working documents — confirm these are not in the client-accessible portion of the engagement

Step 3: Execute the Revocation

For portal-based engagements (Firma): Use the Wrap action to close the engagement. This converts all access to archive mode or closes it entirely based on your preference.

For Google Drive-only engagements:

• Remove client email addresses from all shared files and folders
• Change any "anyone with the link" sharing to "restricted"
• Set read-only access on any archive materials the client should retain access to

Step 4: Verify the Revocation

Don't assume the revocation worked — verify it.

• Log out of your account and attempt to access the engagement portal or Drive folder with the client's email (or ask a colleague to verify)
• Check Google Drive's sharing settings to confirm the client's email no longer appears
• Confirm any "anyone with the link" documents have been switched to restricted

Step 5: Communicate the Close to the Client

Proactive communication turns a security step into a relationship touchpoint.

• Send a close note: "As we wrap up our engagement, I've transitioned your document portal to archive mode. You can still access [specific deliverables] at [portal link] for the next [timeframe]. After that, I'll be in touch about next steps."

This positions the close professionally and gives the client clarity about what access they retain.

---

Frequently Asked Questions

What should be included in an engagement close checklist for document access?

An effective checklist covers: inventory of all shared access points, classification of what to keep vs. revoke, execution of revocation, verification that revocation worked, and a client communication confirming the close and describing remaining access.

How long does the document access revocation process take?

For a portal-managed engagement (Firma): 5–10 minutes including verification and communication. For a Google Drive-only engagement with multiple shared files: 20–40 minutes depending on the number of files. This is the primary operational advantage of portal-based delivery over ad-hoc Drive sharing.

Do I need to tell a client when I revoke their document access?

Yes — proactive communication is strongly recommended. Frame it as a professional service step ("I'm transitioning your engagement to archive mode") rather than a punitive action. Describe what access they retain and for how long. This builds trust and prevents the client from experiencing access denial as a surprise.