Contractor access and orphaned boards
A 250-seat company has 14 workspaces. Three external agencies need to update creative tasks on 22 boards, but they currently have Member access to the Marketing workspace, which also contains the HR salary review board and the Finance budget board. The HR board is private but the workspace admin can see it; the Finance board is shareable. Nine board owners left in the last year, leaving boards with no active owner; two boards were deleted accidentally and restored after four days. Admin is one overworked operations manager. There is no naming convention, and 31 boards are named New board. Contractors occasionally appear in the company directory and receive all-company updates. The company wants least-privilege access, board continuity, and an audit trail for sensitive boards, without buying a new plan.
1. Design the access model for the three agencies and the sensitive HR and Finance boards, naming the specific monday.com controls you would use and the limits you would document.
Read the worked answer
Remove the agencies from the Marketing workspace first; workspace membership exposes every board in that workspace, including boards they should never see. Put the 22 creative boards in a separate Agency Collaboration workspace, or share only those boards with the agency users as guests with edit permission. Keep HR salary review and Finance budget in private boards shared with named employees only; if item-level permissions are not available on the current plan, separate boards are the control. Use view-only permissions for agency users on any board that contains budget or headcount fields, and do not put sensitive columns on the creative boards. Document the limits: guests cannot browse the workspace, board sharing overrides workspace membership only where explicitly granted, and a private board is not a substitute for removing a user from the workspace. Review the agency user list monthly so former contractors lose access.
2. How would you prevent and recover from board ownership gaps and accidental deletions?
Read the worked answer
Set a rule that every critical board has at least two owners or board admins, and one of them must be a current employee in the owning department. Before offboarding, transfer ownership and remove personal automation ownership. Run a quarterly ownership audit from the board list: board name, owner, backup, last activity, sensitivity. For deletions, rely on the trash and restore window, but test the restore process before an incident and document who can restore. Discourage deletion: use an Archive group or archive status, and restrict delete permission to board owners and admins. For the two deleted boards, confirm the restore was complete and check for broken connections, automations, and dashboards that referenced them. Because the admin team is one person, the backup owner is the real control; without it, a single departure creates another orphan.
3. What governance cadence and audit evidence would you put in place for a one-person admin team?
Read the worked answer
Use a lightweight cadence that one admin can sustain. Monthly: access review for guests and external users, automation owner check, and a restore test or trash review. Quarterly: board ownership audit, naming-convention cleanup, and a review of the 31 New board items for archive or rename. Onboarding and offboarding: a checklist that assigns board owners, transfers automations, and removes workspace membership. Evidence: exported membership lists, a board register with owner and backup, automation owner notes, and a log of restores and permission changes. If the plan lacks a full audit log, keep the register manually and attach screenshots of activity where needed. The goal is not a perfect audit trail; it is proving that sensitive boards have named owners and that contractor access is reviewed on a schedule.