Your agency isn't slow, it's locked out

September 23, 2026resolves JRN 26-044

Every 'can you send us' is a decision nobody ever made.

Here is the thing nobody tells you before you sign.

The best predictor of whether a local marketing engagement produces anything is not the agency’s talent. It isn’t your budget, your industry, or how good the pitch deck was. It is something much more boring:

How many things can they do without stopping to ask you?

That number is the whole relationship. And almost nobody negotiates it on purpose, which is why so many of these arrangements feel like wading.

Why it’s that and not talent

The work is not one big brilliant move. It’s a few hundred small corrections — a wrong phone number on a listing, a page that loads slowly on phones, a tag that stopped firing in July, an hours change before a holiday weekend, a service you started offering in March that isn’t on the site yet.

Each one is fifteen minutes of actual work.

Now price in the version where they don’t have access. Someone notices the problem. They email you. You’re on a roof. Three days later you reply asking which login they mean. You send a password over text, which is its own problem. It’s the wrong account. Repeat.

Fifteen minutes becomes nine days, and — this is the part that actually costs you — most of those corrections simply never get made. Not because anyone decided they weren’t worth it. Because the friction was higher than the payoff and everyone quietly moved on to something easier.

An agency that can act does twenty small things a quarter. The same agency, locked out, does four and spends the rest of its time writing you emails about the other sixteen. Same people. Same skill. Same invoice.

Autonomy isn’t a gift. It’s a negotiation.

The wrong conclusion here is “give them everything.” Don’t. Some decisions should never leave your desk, and any company that wants blanket control without a conversation is telling you something.

The right move is to actually have the conversation, once, properly:

• What can they change on their own?
• What do they have to run past you first?
• What is never theirs — spend above a number, anything with your licence or legal name on it, anything that touches how customers are billed?
• What are they allowed to see but not touch?

Those are ordinary business questions. You’d ask them of a new office manager without blinking. Almost nobody asks them of a marketing company, and the result is an unwritten arrangement that both sides guess at for two years.

Except that conversation is nearly impossible to hold

I want to be fair about why it doesn’t happen, because “just communicate better” is the kind of advice that has never fixed anything.

To have it properly as a meeting, you would need to already know that you have a tag container. Whether your listing was ever actually verified, and by whom. Who set up your analytics in 2019 and whether that person still works anywhere. Which of the four Google things you own, which you half-own, and which one is a duplicate somebody made in a hurry.

And the agency would have to ask you twenty precise questions in a row without it turning into an interrogation, then remember every answer, then notice six weeks later when one of them stops being true.

Nobody does that. Both sides get through about four items, agree to “circle back on the rest”, and the remaining sixteen become email, forever. This is the normal outcome and it isn’t anybody’s fault.

So the fix isn’t a better meeting. The fix is a place where the conversation is already laid out and you just fill it in.

That’s what the VIP area is for. Instead of sitting down and negotiating access from memory, you open a list and input the things we need in order to start work. Each item says what it is in plain language, why we need it, what it actually lets us do, where it currently stands, what it unlocks for you, and the one next action. You are never expected to know what to ask, or what the thing is called, or whether you have one.

The conversation still happens. You’re just not the one who has to know how to run it — and it doesn’t depend on anybody remembering a phone call from March.

And here’s the part that makes it concrete rather than philosophical.

Those decisions get negotiated, defined, and then remembered as keys.

That’s the mechanism. A permission level on an account is a decision about autonomy, written in a form that outlives the conversation. Who holds which key, at what level, on which account, is the only durable record of what you agreed. Not the kickoff call. Not the contract, which says “digital marketing services” and nothing useful. The key ring.

Which means the key ring is also the memory. When your contact leaves, when the agency restructures, when you switch companies in three years — the keys are the part of the relationship that didn’t walk out of the building.

The diagnostic, and this is the useful bit

So here is a test you can run on your current arrangement today. If several of these are true:

• Most requests come back to you as “can you send us…”
• Things that sound small take a week
• You’ve been asked for the same login twice
• Nobody can tell you the status of something without checking with someone else
• Work stalls and nobody can say exactly what it’s stalled on
• You get a monthly report but no one has changed anything

…the diagnosis is almost never that they’re lazy or stupid. They’re locked out. You are watching an access problem wearing a personality.

Every “can you send us” is a decision nobody ever made.

That’s worth knowing because it changes what you do about it. “They’re not very good” leads to firing them and starting the same cycle with someone new in nine months. “We never sorted out access” leads to a two-hour session that fixes it permanently — and it’s the same two hours whoever you hire.

What it looks like when someone has done this work

This is where I’ll show you ours, not because you should use it, but because it’s easier to demand something once you’ve seen the shape of it.

Onboarding is two collections, and they’re kept apart.

Access — the permissions that let work happen on things you own. Context — the facts the work has to be correct about: legal name, licence number, the jobs you want more of, the jobs you’d rather never see again. In our portal they’re two sections, Connect and Intake. Ten connections. Four sections of questions. A page that asks for your mobile number and an API token in the same list, as though those are the same kind of thing, is a page nobody finishes.

Nobody should ever ask for your Google password. Not us, not anyone. There has been a way to grant a company access to a Google account without giving them the password for fifteen years — it’s what the “Continue with Google” button does. An agency asking for the password instead has told you something about the next twelve months. Same for Microsoft, your bank and your phone.

Everything starts red, and green is not a receipt. A connection turns green when we have used it and it worked — not when you sent something. A key handed over is a claim, and the claim can be about the wrong account, a key rotated in March, a permission one notch below what the job needs, or a token that expired in a drafts folder. None of those look different at the moment they’re pasted in. The rule as it’s written in our own code:

a connection is connected only when a real probe succeeded. Supplied but unvalidated is not connected, and that distinction is the whole reason the checklist is believable.

There are three shades of red, too: failed means it was never right, expired means it worked and stopped, revoked means someone took it away. Those need different sentences and you shouldn’t have to guess.

Two kinds of ask, and mixing them up is why setup pages are miserable. Sometimes there’s no secret at all — we hand you an address to add to a system you own, the way you’d add a bookkeeper to your accounting software. Sometimes there’s a value only you can mint, and it goes to a vault and never comes back to a browser, a log, a support ticket or a URL. A page that says “paste your Search Console key” has confused the two, because that key doesn’t exist. You’ll hunt for twenty minutes, assume you’re the problem, and stop. You weren’t the problem.

Before anything gets created, five possible answers — and only one of them makes something new:

The reason that order matters has a name: the duplicate Google Business Profile — the listing that puts you in Maps and in the local results box. When an agency can’t get into your existing listing, the fast fix is to create a new one. Now there are two. Fourteen years of reviews are on the old one, your correct hours are on the new one, Google shows whichever it prefers that day, and merging them is a support case measured in weeks. The same move on your analytics gives you a second property counting from zero, and throws away the history you’d have used to prove anything worked.

So no duplicate listing, property or container gets made without the existing one being named on screen first and a straight yes from you — and nothing gets created or changed in your accounts until you’ve seen exactly what it is.

Some steps are only ever yours. Controlling your domain’s DNS does not give anyone access to your mailbox; those are different systems with different owners. So verification links, six-digit codes and postcards come to you. Those become labelled tasks that hold your place — you leave, do the thing, come back to the same spot instead of starting over. We’ll never ask for your email password, and we don’t touch the records that route your mail unless it’s required, explained and approved.

Things unlock when they’re actually ready. Twelve features, each shut until both the access and the context behind it are real — not when a box is ticked. The site won’t publish until your legal name, phone, address and licence are confirmed, because those end up on every page and in everything Google reads about you. And a locked feature always says what’s missing, because “locked” on its own is a dead end.

Dated, so you can hold me to it. 23 September 2026. Built today: the connection list, the probes behind the green lights, the vault the secrets go into, the intake questionnaire with saved progress, and the logic that decides what’s unlocked — that last one under fifty-four passing tests, because a checklist showing green is exactly as convincing whether or not the rule behind it is sound. Being built: provisioning — creating an analytics property, a tag container, a search console property and its verification record on your behalf, each behind an explicit approval, built so a retried setup never makes a second copy of anything.

Four questions, for whoever you hire

Not just us.

1. Will you ever ask me for a password to a third-party account? The answer is no, and it should come back instantly.
2. How do you know that access works? “We’ve got the login” is not knowing. That’s a claim.
3. What will you create inside my accounts, and do I see it first? Specifically: will anything be duplicated.
4. Which decisions are yours to make without asking me, and which are mine? If nobody has ever asked you this, nobody has thought about it.

That fourth one is the real one. The first three are how you tell whether the answer to it is going to be honest.

Trust in a local marketing company isn’t a feeling you arrive at over time. It’s a set of decisions somebody wrote down, in the only form that remembers.