Who Owns Your Workflow When the Automation Agency Leaves?

Ownership is a demonstrated ability, not a sentence in a proposal

Your business can continue a workflow after an agency leaves only if a designated employee can access the production accounts, obtain usable configuration or code, renew connections, see failures, stop unsafe actions and run a documented fallback. Intellectual-property language and platform permissions are separate questions: have counsel review the contract for rights to code, data, licenses and assistance on exit, then prove operational control in the actual accounts. An export file alone does not carry every secret, subscription, external dependency or execution history. Ask for a witnessed handoff drill before final acceptance, not just a promise to send documentation later.

• Name a business process owner who approves outputs and a technical operator who can inspect and change the workflow.
• Agree in writing which artifacts, accounts and support period are in the project scope; this guide does not assert GLCO's contractual handoff terms.
• Use a read-only or sandbox exercise first; never test an exit by turning off an unprotected production process.

Put the account and project in the buyer's control before building

Create the production workspace or instance under a business-controlled billing identity, grant the agency named, least-privilege access and keep a second internal administrator. Record the workflow's actual owner, project, service accounts and external application accounts rather than treating a shared login as transfer. n8n illustrates why this detail matters: its workflow-sharing page says ordinary workflow creator ownership cannot simply be changed except on user deletion; its project documentation separately describes supported moves of workflows and credentials between accessible users or projects, with existing sharing removed and connections potentially affected. Those are distinct operations, not a promise that an editor can take over every workflow. n8n Cloud and self-hosted plans also differ in access and sharing availability, so check the chosen plan and project roles before building.

• Have an internal administrator log in and locate the production workflow and its credentials without the agency's account.
• Check whether the agency built in a personal workspace, a shared project or its own external instance; record the supported move or rebuild route if the location is wrong.
• Do not delete a user or move a live workflow as a casual ownership test; first evaluate permissions, sharing loss and credential dependencies.

Further reading: n8n workflow sharing and owner limits·n8n project moves and access effects

Request an export manifest with a pass condition

For each row, the receiving operator should record artifact name, version or export date, storage location under business control, responsible supplier, receiving person and pass/fail evidence. Use sanitized fixtures and access-controlled storage. The manifest is not complete when it merely lists assets: the recipient must retrieve or exercise them. Some hosted products export workflow definitions but not all historical runs, account entitlements or usable credentials; document what cannot be exported and the alternative continuity method.

• Include an architecture diagram showing trigger, data stores, third parties, approval point and the point where a write becomes irreversible.
• Keep a dependency inventory of plan, region, API scopes, environment settings, webhooks, custom packages and billing owner.
• Record any non-exportable component as a named risk with a tested workaround or a decision to retain the current platform.

Run the exit drill without production side effects

Schedule the drill while the builder is still available, with the business operator driving and the agency observing. Export the current definition or retrieve the repository version, import or deploy it into a separate environment, connect newly issued test credentials, and run the approved fixture set against a safe destination. Compare outputs and identifiers with the expected results; check that a duplicate is held and that an unavailable destination produces an alert and a recoverable item. n8n documents JSON workflow export and import, but warns that exported JSON can include sensitive credential names or authentication headers in HTTP nodes. Inspect and protect the export; do not publish it as a harmless diagram. Workflow JSON is not proof that secrets and external accounts transferred.

• Capture the exported version, test environment, fixture IDs, observed result, reviewer and any discrepancy in the manifest.
• Have the operator locate the original failed input, decide whether a retry is safe, and demonstrate a manual completion route.
• Treat a successful copy-and-import as only a definition test until credentials, schedules, webhooks and alert delivery also work.

Further reading: n8n export/import behavior and JSON warning

Transfer connections by reauthorization, then revoke builder access

A credential inventory is more useful than a password dump. The business should control the source and destination accounts and issue or reauthorize tokens with the minimum permissions needed; rotate agency-issued keys after the replacement connection is tested. For OAuth integrations, confirm which user or service account granted consent and whether a departing person's identity will invalidate a connection. n8n's credential-sharing documentation says sharing can allow use without showing credential details, and availability differs by hosting plan. A workflow editor may be able to run with a shared credential without being able to inspect or re-create it. Ask the recipient to perform the reconnect in the test environment, then remove the agency's project access and verify production still functions under agreed supervision.

• Inventory each connection by system, owner, scope, expiry, renewal method and revocation contact, not by plaintext key value.
• Check workflow nodes for embedded headers or secrets before handing around an export.
• If no safe reauthorization path exists, mark handoff failed and keep the agency access change pending a controlled remediation plan.

Further reading: n8n credential sharing limits

Prove alerts, pause and rollback with a named operator

The operator must know which failure creates an alert, where run history lives, who checks the source record, and how to pause intake without losing queued work. In the test environment, trigger a destination failure; the operator should receive an alert, find the run and original input, stop further writes, route pending items to a manual queue and restore the last known-good definition. A rollback of workflow code does not undo a payment, outbound message or already-written record, so define reconciliation and correction authority separately. Keep production changes under an approved change window and verify the destination's state before replaying anything.

• Write down an expected alert-response window and who covers absence; do not assume an agency support contract continues after exit.
• Record the last known-good version and the conditions for re-enabling the workflow.
• For irreversible actions, keep human approval and a correction procedure rather than promising automatic undo.

Sign off on evidence and unresolved limits

At handoff, the business process owner and replacement operator should date the manifest and mark each drill result pass, fail or not applicable with a reason. Resolve failures before accepting operational handoff, or explicitly accept a bounded residual risk with an owner and deadline. Platform plans, export formats and retention settings may change; the n8n primary documentation linked here was checked on September 24, 2026, and describes current product mechanics, not legal rights or a guarantee that another platform behaves the same way. If you need help scoping this exit test or rebuilding an inaccessible workflow, bring the current account map, a redacted workflow example and the list of failed checks to /contact. Confirm any contractual delivery and support terms directly; no offer or outcome is implied by this checklist.

• Require a copy of the signed gap list in business-controlled storage.
• If no employee can execute the test without agency credentials, do not declare the handoff complete.
• Rehearse again after major platform, account-owner or connector changes.

Further reading: Discuss a handoff scope·Explore GLCO's process service·Compare automation providers