Dragging our TikTok login out of the shared marketing vault and dropping it into a one-off item share, I catch myself doing the thing I used to make fun of my old IT team for: overthinking a single password. But that's the job now. Credential management for a marketing ops team isn't about picking a vendor and calling it done, it's about deciding, login by login, who actually needs standing access to what. Vaults hold the stuff people touch every week. Item shares handle the one-time stuff. Mix those two up and team security turns into a guessing game, the same guessing game the shared spreadsheet used to be.
Someone asked me about this exact split a few weeks back: Cressida, an account manager out in Phoenix who emails me more follow-up questions than my actual IT department ever did, wanted to know why I don't just give every contractor vault access and call it a day. Fair question. The honest answer is that vault access and item sharing solve two different problems, and most of the trouble I've seen on marketing teams comes from picking whichever one is easier in the moment instead of whichever one matches the actual risk.
Vault Access Versus Item Sharing
Vault access is the blunt instrument, and I don't mean that as an insult, since sometimes blunt is exactly right. Give someone access to the "Marketing - Social" vault and they can see everything living there: the scheduling tool, the stock photo login, the ad account. That's fine for a person who's going to touch all of it, week after week, for as long as they're on the team. I wrote a while back about the best ways to secure marketing SaaS logins after a phishing scare, and the short version holds here too: standing access should map to standing responsibility, not convenience.
Item sharing is the scalpel. When a freelance copywriter needs one landing-page login for one week, I don't hand them a vault key, I hand them that single item, and I set it to expire before the invoice is even due. My phone still buzzes with a second-factor code every time I run a login test, same as it always has, which after years of doing this the wrong way still feels like a small miracle. Soledad, my manager, stopped asking me to walk her through the difference a long time ago and just tells contractors to email me directly, which tells you everything about how much technical judgment she wants to exercise personally: none. We hashed out that division of labor on a walk at the Barton Creek Greenbelt trailhead, back when the two of us were the only ones on the team who'd even opened a vault app.
Determining Which One Someone Actually Needs
Here's the test I actually use, and it isn't complicated: if someone's job touches the same five or six logins every single week, they get vault access, full stop. If they need exactly one login for exactly one deadline, they get an item share with an expiration date, no exceptions. The mistake I see most marketing managers make is building a brand-new vault for every project instead of asking that question first. Fifty vaults later, nobody remembers who has access to what, and you've just built a more organized version of the same mess the spreadsheet was.
The Sticky Note That Made Everything Worse
Long before I trusted any of this, I kept backup codes for two-factor logins written on a sticky note, tucked under the keyboard of the laptop I use for testing vault apps. It felt clever at the time: physical, off the grid, nothing a hacker on the other side of the world could touch. What it actually meant was that anyone who walked into the room could get past two-factor authentication in about four seconds, which defeats the entire point of having it. 1Password's emergency kit replaced that habit eventually, though I won't pretend I explain how it works every time I talk about vaults, since that's really its own topic. The lesson outlasted the fix: a security habit that only works because nobody's looked under your keyboard yet isn't a security habit.
Credential Management Is a People Problem
None of this matters if the master password guarding the whole vault is weak, and that's a separate rabbit hole I won't fall into here beyond saying: make it long, make it yours, and don't reuse it anywhere else. Underneath all of it sits AES-256 encryption, with something called PBKDF2 standing guard over that master password, and I'll spare you the math lecture I used to give people at parties before their eyes glazed over. What actually catches problems day to day is a Watchtower report flagging reused or stale logins across the shared vaults, the same way I once ran an audit on our old Bitwarden setup and turned up a dozen logins nobody had touched in months, then spent most of a lunch break quietly rotating every single one before anyone noticed they'd been sitting there exposed.
Full-time hires follow the same logic as contractors, just on a longer timeline. When somebody leaves the team now, I revoke vault access in about the time it takes to close the laptop, instead of the frantic scramble it used to be. I've made the case before for why marketing teams need a password manager vs browser storage, and vault sharing is a big part of why: browser storage has no concept of item-level sharing at all, so teams that rely on it default to giving everyone broad access, simply because splitting off one login was never on the table. Moving all of this to a different vault provider someday would be its own headache, one I've picked apart elsewhere, so I'll leave it there.
Pick One For Every New Person, Not Both
So here's where I've landed, and it isn't more complicated than this: choose vault access for anyone whose role means touching the same set of logins on a recurring basis, whether that's a full-time hire or a contractor who isn't going anywhere soon. Choose item sharing for anyone whose need is bounded: one project, one login, a deadline you can name. Cressida's question, the one that finally got me writing this down properly instead of re-explaining it over email, was really asking which option removes more risk. Neither one does, on its own. The vault decides who gets standing access, the item share decides who gets a narrow, timed exception, and a marketing team that only uses one of the two tools ends up right back where the spreadsheet left them: everyone with access to everything, and nobody quite sure why.