Rotate contractor access after handover

Direct answer

Do not revoke the departing operator until a replacement has accepted the inventory and can perform a bounded task.

Close a handover by making access changes attributable and checking the replacement can operate safely.

Illustrative example

Illustrative example: a client replaces an agency. The client confirms registrar ownership, the new operator performs a recovery-location check, then the outgoing credentials are rotated and the old access list is reviewed.

Work through the decision

1. List access paths, owners, recovery methods and dependencies.
2. Give the replacement their own approved access and a bounded acceptance task.
3. Rotate shared secrets and revoke unneeded access after acceptance.
4. Record unresolved items, owner and next review date without storing secrets.

What this does not establish

A contact email confirmation in checkout is not a substitute for application or server access transfer.

Technical reference: OpenSSH sshd manual. Check the installed software and operating context before applying any command or change.