A practical guide to “Which access credentials and accounts should belong to the client”, covering the key steps, decisions, and common mistakes.