Offer the least access that answers their real question. Usually that is an evidence walkthrough, a screen share of live settings, or a redacted export, not credentials. Direct access to production should be a last resort with written scope, dates, contacts and revocation. Ask what they are trying to verify before you choose.
Find the underlying question
A request for environment access is rarely about access. It is about a doubt: are backups real, is MFA enforced, are access rights reviewed? Name the doubt, then pick the evidence that settles it. Most reviewers accept a walkthrough once the question is explicit.
Options from least to most access
| Option | What the customer sees | Risk to you |
|---|---|---|
| Document pack | Policies, summaries, test records | Lowest |
| Live walkthrough | You show settings on a call and answer questions | Low |
| Redacted export | A configuration or log extract with identifiers removed | Low to medium |
| Sandbox access | A separate non production tenant they can test | Medium |
| Scoped test of production | A defined test with written rules | High |
| Read access to production | Customer staff inside your systems | Highest |
Decision steps
- Ask which control or claim they want to verify.
- Offer the lowest row in the table that can settle it.
- If they need more, move down one row at a time and say why.
- For anything beyond a walkthrough, agree written scope, dates, named contacts and what is off limits.
- Use a time limited account that is created for the purpose and removed afterward.
- Log what was shared, with whom and when, and confirm revocation in writing.
The walkthrough, done well
Prepare a short script. Show the identity provider's MFA setting, the list of administrators, the branch protection rule, and the backup job history. Have a second person watch for anything sensitive on screen. Do not improvise in a live session; a customer's screen recording is a document you did not review.
Take notes on what was shown and send a follow-up with the date and items covered. That note becomes evidence for the next review.
Sandbox testing
If you offer a sandbox, keep real customer data out of it, use unique credentials per tester, and state the acceptable testing rules in writing. This is a business control, not legal advice, so involve counsel where contract terms govern audit rights.
What to refuse politely
Shared accounts, standing production access, and open ended permission to scan your infrastructure are not reasonable asks for a normal review. You can say: "We can show you the control directly and provide dated evidence, and we can discuss a scoped test with agreed rules." That response is firm and cooperative.
Where Safeguard fits
Safeguard's compliance and evidence automation produces dated, exportable records of controls, which lets you answer many access requests with evidence instead of credentials. You can also run a free scan at https://gold.safeguard.sh/scan.
Quick check
Should we ever give a customer production credentials?
Rarely. Try a walkthrough or redacted export first. If access is unavoidable, scope it in writing, time limit it and revoke it.
What should we record after a walkthrough?
The date, attendees, items shown and any follow-ups, sent back to the customer in writing.
Last reviewed: 19 October 2026.
