Do not leak client work inside an agency workspace

Open a company record instead of cloning accounts. A designer only sees the brand they are assigned. A manager report sees totals, not the file tree. “Admins see everything” drops a client folder all the way to the intern. An agency leak is rarely malice — it is a wide role. Pick the role at invite time. Never default to admin. A viewer is read-only; they do not download the brief to another studio.

You do not need a workspace invite to show a draft. A passworded doc link is enough; the door closes when it expires. The brief stays on the task. A pitch document shares without a client account. Winning work later opens as a project. A lost pitch stays in archive and does not leak to another brand. Do not mix the outer door with the inner grant.

A monthly retainer is a list, not a second tool. A campaign is a feature or a milestone. The task sits in both. The billable tag is a cross-cut; the report produces effort from that tag. A second “agency Excel” is not born. A client viewer does not see the internal note on the retainer queue. In the status vocabulary “client approval” is its own column; it does not mix with internal production.

Who sees this folder? Does this seat still belong to a person? Is this external link still open? Did this “test admin” drop? An agency quarter closes on those four questions. You do not maintain an Excel matrix; the record is the grant. A forgotten link is the most common leak path. “The door closes when time is up” should be written down, not left to memory.

The leak is rarely malice — it is the “just let them look” admin. Brand A’s designer sees B’s brief. An intern opens a folder. A forgotten pitch link stays open six months. Ontra answers with fine-grained access, a company boundary, and a timed outer door. Open a company record instead of cloning accounts. A designer only sees the assigned brand. A manager sees totals, not the tree. A viewer does not download the brief to another studio.

A retainer is a list, a campaign is a feature or milestone, the brief binds to the task. The billable tag feeds effort. A second agency Excel is not born. A client viewer does not see the retainer’s internal note. “Client approval” is its own column and does not mix with internal production. A pitch is shown with a password, not a workspace invite. On a win the project opens. A lost archive does not leak to another brand.

A quarter closes on four questions: who sees this folder, does this seat belong to a person, is this external link open, did this test admin drop? You do not maintain an Excel matrix; the record is the grant. A forgotten link is the most common leak path. Write down “the door closes when time is up.” Role is required at invite. No default admin. These nos are not stinginess; they are a contract boundary.

The leak is just-let-them-look admin. A’s designer sees B’s brief. An intern opens a folder. A pitch link stays open six months. The answer is fine-grained access, company boundary, timed outer door. Open a company record do not clone accounts. A designer only sees assigned work. A manager sees totals not the tree. A viewer does not carry the brief to another studio. Retainer is a list, campaign a feature, brief a task. Billable feeds effort. A second Excel is not born. Client approval is its own column.

A pitch is shown with a password without an account. On a win the project opens. A loss does not leak. Quarter four questions: who sees, does the seat belong to a person, is the external link open, did test admin drop. No Excel matrix the record is the grant. A forgotten link is the most common path. Write down the door closes. Role required at invite. No default admin.

These nos are a contract boundary. Rival brands can sit in the same studio because the rooms are separate. The room is the grant. An admin shortcut destroys the room.

When you win new work do not open it to everyone in excitement. First the company record, then the role, then the folder grant, then an optional passworded door. Reverse the order and the leak is born the same day.

A new-business pitch shares with a passworded link, not a workspace invite. When it expires the door closes; winning work later opens as a project. A lost pitch stays in archive and does not leak to another brand.