The access answers above are right, but the thing that will actually stop you is not access, it is A2P. Before a single review SMS leaves that sub account you need 10DLC registration approved: brand and campaign, filled in with the client's legal business name, EIN, business address, website and sample messages. That takes anywhere from a day to a couple of weeks and it gets rejected for small stuff, like a sample message with no opt out line. A lot of people build the entire workflow, hit send, and then watch every message silently fail with nothing in the UI telling them why. So the actual ask list from your client is shorter than you think: Legal business name, EIN and business address, for A2P. Their Google review short link, which they pull from their Google Business Profile under Ask for reviews. It looks like g.page/r/something. That is the entire Google piece, zero account access. The past customer list, names plus phone and email, and their word that they have permission to contact those people. If you want email coming from their domain, DNS access or a person who has it, so you can add the sending records. That is the only credential shaped item on the list, and it is DNS, not his Gmail password. Second thing that bites people here. Do not import 500 contacts and fire them all on day one. A brand new number pushing a few hundred SMS in an afternoon looks exactly like spam to the carriers, so it gets filtered and the number gets flagged, and you will never see a bounce that explains it. Drip 20 to 30 a day. Slower, and it is the difference between a number that works in month two and one that is dead. One more on old customers specifically: put the time gap in the message instead of pretending it is not there. Something that acknowledges it has been a while reads like a human. A cold review ask about a job from two years ago reads like a bot.