An affiliate agency in Southeast Asia somewhere between fifty and two hundred people is running creator programmes for a dozen apparel brands across Indonesia, Thailand and Vietnam. Each brand has its own TikTok Shop. Each shop has an account manager who personally knows which forty creators actually post, which eleven are worth a higher commission, and which one asked for a flat fee last quarter and was told no.
That person resigns on a Friday.
What happens next is not an abstract knowledge-management problem. It is four specific things going missing at the same time, and only one of them is the password. Agencies lose roughly two weeks per departure rebuilding context that already existed, and the cost is not the two weeks — it is the creators who went cold while nobody was watching them.
This article is about separating the store access, the creator records and the relationship context from the individual holding them, so that a resignation becomes an admin task instead of a rebuilding project. It assumes you have more than one person touching creator outreach and at least one person who has left in the last year.
One boundary up front. Access control is not relationship insurance. If a creator has only ever spoken to one person on that person’s personal WhatsApp, no account structure recovers that conversation. What you can fix is everything that happened inside the store and the platform, and that turns out to be most of the recoverable value.
The Four Things That Leave Together
The first is obvious: store access. The login was created by the leaver or shared with them in a chat message two years ago, and nobody has rotated it since.
The second is the creator list itself. This is the one that hurts, and it usually is not stored where you think. It lives in saved lists inside a TikTok account the leaver logged into personally, or in a spreadsheet on a drive that belongs to them, or in a series of direct messages where they simply knew who to contact.
The third is negotiated terms. Commission exceptions, sample limits, flat-fee arrangements, exclusivity windows agreed for a campaign. These are almost never in a document. They are in DMs.
The fourth is working knowledge — which creators reply after 9pm, which need the sample in hand before they will commit, which market expects a written brief before a yes. This is the layer teams underestimate, because it feels like instinct rather than data, and it is the layer a replacement needs most in week one.
None of these four are protected by a password policy, which is why password policies keep failing to fix this.
Why Shared Credentials Survive Every Policy You Write
Agencies know sharing logins is wrong. They do it anyway, and the reason is not carelessness.
It is onboarding speed. When you add eight account managers a quarter across a dozen client shops, handing someone a working login takes two minutes. Provisioning proper scoped access takes a day, sometimes two if the client has to approve it. Every agency headcount surge produces the same outcome: the shortcut wins because the shortcut is faster than the process.
Three other forces push the same direction. Clients frequently hand over their own store credentials because they do not know another mechanism exists. TikTok Shop stores are often registered to the brand rather than the agency, so the agency never had master access to delegate in the first place. And when someone leaves unexpectedly on a Friday, whoever is covering on Monday needs to be inside the shop that morning — not after a provisioning ticket closes.
This is why telling people to stop sharing passwords produces almost no behaviour change. The alternative has to be faster than the shortcut, not merely safer.
Moving Access From the Person Onto the Role
The structural fix is to stop granting access to humans and start granting it to roles, then attach humans to roles.
Concretely: a master account authorises the stores and the accounts once. Scoped sub-accounts are then assigned to whoever is doing the work. The sub-account holder logs in without ever receiving or holding the store’s username and password — there is no credential to leak because none was transmitted.
What that changes at departure is the whole point. Offboarding becomes revoking one sub-account. The stores stay authorised. The creator records attached to those stores stay where they are. Nobody rotates passwords, nobody worries about who else has the old one written down, and the replacement is provisioned into the same scope the previous person had rather than into something a colleague improvised.
It also fixes a quieter problem: overlap. When a leaver and a replacement both need access for two weeks, scoped accounts let both work simultaneously without either of them sharing anything.
| Shared login | Personal TikTok account | Role-based sub-account | |
|---|---|---|---|
| What survives a departure | Nothing — credential must be rotated | Whatever the person chooses to export | Store authorisation and all creator records |
| Who can revoke access | Anyone who changes the password | Only the account holder | Master account, in one action |
| Records attributable to a person | No | No | Yes — outreach and fulfilment logged per sub-account |
| Two-week overlap possible | Technically, insecurely | No | Yes |
The middle column is the one most agencies are actually in, and it is worse than the left one, because at least a shared login is visible to the team.
What Role-Based Access Does Not Fix
This is where agencies oversell the fix internally, then get surprised.
It does not recover conversations held off-platform. A creator who negotiated over WhatsApp with the leaver’s personal number is gone, and no sub-account structure reaches that. If your market runs on WhatsApp — and in Indonesia and Thailand it largely does — this is the single biggest remaining gap, and it is a policy problem, not a tooling one.
It does not prevent deliberate export. A sub-account holder with legitimate access can still screenshot a list or copy it into a spreadsheet before they leave. Role-based access removes accidental loss, which is the common case, not malicious loss.
It does not write down context. Someone still has to record why a creator was excluded, what was promised, and what the next step is. Access control makes the record possible; it does not create it.
And it does not help when the brand owns the master account and will not delegate. If your client holds the store and hands your team a login, you cannot fix this unilaterally — you have to raise it as a contract point, because the alternative is every departure being the brand’s problem too.
The Record Layer: Who Said What to Whom
The piece that turns a handover from a rebuild into a continuation is attribution.
When invitations, messages, sample shipments and their outcomes are logged against the sub-account that sent them, the incoming person inherits state rather than a blank page. They open the creator record and see the last contact date, what was offered, whether the sample shipped, whether content landed, and whether the creator has posted anything since.
That is the difference between a replacement asking “who do I even contact?” and a replacement asking “these eleven are warm, what is next?”
Two conditions make this work in practice. Records have to be written as the work happens, not reconstructed at exit — a handover week spent writing down history from memory recovers maybe half of it. And the record has to be visible to the team, not just to the individual, which is precisely what the personal-account model prevents.
If you are designing the team structure that this sits inside, TikTok Affiliate Team Management: An SOP That Scales covers the roles and ratios, and Creator Marketing Team Structure: Roles, Ratios, and Growth Stages goes at the same question from the headcount side.
Running the Handover as a Process
Four things, in order.
Move the leaver into the shared account before they leave, not after. If their last two weeks are still spent inside a personal login, those two weeks of outreach are unreachable the day they go. The overlap is only useful if it happens inside the system that survives them.
Reassign creators by tag, not by recall. Asking someone to write down “their” creators loses the long tail — the forty-nine they would not have thought to mention. Reassigning by segment, market or stage transfers all of them.
Kill the password handover ritual. If the leaver’s final act is messaging someone a password, everything else you built is decorative. There should be no credential to hand over.
Do the exit review at thirty days, not on the last day. The failure mode shows up later: a creator who always replied to the old manager and has gone quiet. That is visible in the record, but only if somebody is looking a month out.
Where DAMI Fits
DAMI handles this at the point where access and records meet. The master account authorises stores and accounts once and assigns scoped sub-accounts to whoever is running the outreach, so no store credential moves between people at all. Sub-account holders sign in without a username and password, and the panel synchronises each sub-account’s outreach and fulfilment records into one view.
That last part is what makes the handover work rather than merely being survivable. When somebody leaves, the creator records do not travel with them, because they were never attached to a person — they were attached to a role and logged against it. The incoming account manager opens the same records, sees the same history, and continues.
The honest limit: DAMI cannot recover what happened outside the platform. WhatsApp threads, personal relationships, verbal agreements — those are lost the same way they always were, and no amount of account structure changes that.
If you want the access model described above rather than a shared spreadsheet of logins, the product page shows how the master and sub-account split works in practice.
Frequently Asked Questions
Does a sub-account setup slow down onboarding?
It should not, and if it does you have built it wrong. Provisioning a scoped sub-account has to be faster than handing over a password, otherwise people will keep handing over passwords. Budget for same-day provisioning or the shortcut wins.
What if the brand owns the store and will not give us master access?
Then you cannot fix it alone, and you should stop pretending the access model protects you. Raise it at contract renewal as a named requirement. In the meantime, at minimum get your team off personal accounts, because that is the worst of the three options.
How do we handle creators who only talk on WhatsApp?
Move the relationship onto a business number owned by the company rather than a personal one, and log the outcome against the creator record. You will not capture the whole conversation, but you stop the number itself from leaving with the person.
Should the replacement inherit the same commission exceptions?
Yes, and this is exactly why terms belong in the record rather than in DMs. A replacement who does not know a creator was promised 18% will reopen a settled negotiation and damage the relationship.
Is this worth doing at twenty people, or only at two hundred?
At twenty it is worth doing before the first departure rather than after. Agencies typically hit the pain at the third or fourth exit, by which point the rebuilding cost has already been paid several times over.
