--- title: "Take control of every account before ยท Agent Wranglers" url: https://agentwranglers.se/playbook/codebase-takeover/triage/take-control-of-accounts id: TKO-1 level: Required risk: takeover updated: 2026-10-22 tokens: 926 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Take control of every account before touching the code For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Triage](https://agentwranglers.se/playbook/codebase-takeover/triage.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22. - ID: TKO-1 - Level: Required - Chapter: [Triage](https://agentwranglers.se/playbook/codebase-takeover/triage.md) - Rule: Before the first change, list every account the product depends on. Give the company at least two admins on each, and remove every person who has left. - Check: The access list names every account in the list above that the product uses. Each has at least two current company admins who can sign in, and no member who is not on the current staff or contractor list. - Risk: An account or system taken over - How: Inherited products often run on a founder's personal email, an agency's cloud account or a builder seat nobody pays for. Whoever holds those accounts can delete the product or read its data. The list covers the code host, the cloud or hosting account, the domain registrar and DNS, and the database. It also covers the email sender, the payment provider, the AI builder, the app stores, analytics and the error tracker. Move the domain as [Own the domain and DNS in your own accounts](https://agentwranglers.se/playbook/infrastructure/hosting-platforms/own-domain-and-dns.md) says. Protect the code host as [Protect the accounts that can change the code](https://agentwranglers.se/playbook/engineering/version-control-and-review/code-host-accounts.md) says. Remove former staff and contractors by the deadline in [Remove access within a day of leaving](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/offboarding-within-a-day.md). ## Sources - [GitHub on ownership continuity for an organization](https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/maintaining-ownership-continuity-for-your-organization) ## Related rules - INF-68 [Own the domain and DNS in your own accounts](https://agentwranglers.se/playbook/infrastructure/hosting-platforms/own-domain-and-dns.md) in Infrastructure and environments - ENG-20 [Protect the accounts that can change the code](https://agentwranglers.se/playbook/engineering/version-control-and-review/code-host-accounts.md) in Engineering - CMP-30 [Remove access within a day of leaving](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/offboarding-within-a-day.md) in Compliance and governance - TKO-2 [Rotate every secret the previous team could read](https://agentwranglers.se/playbook/codebase-takeover/triage/rotate-inherited-secrets.md) in Codebase takeover - TKO-7 [Fix in risk order](https://agentwranglers.se/playbook/codebase-takeover/triage/fix-in-risk-order.md) in Codebase takeover - TKO-27 [Build the product from the company's own repository](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/build-from-own-repository.md) in Codebase takeover **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers codebase takeover playbook`. In code you write, add a comment next to it with the same link. - Next: [Rotate every secret the previous team could read](https://agentwranglers.se/playbook/codebase-takeover/triage/rotate-inherited-secrets.md) - [Triage](https://agentwranglers.se/playbook/codebase-takeover/triage.md)