I think the following policy should apply to company user accounts (not personal ones like Facebook or Google accounts, but accounts at workplaces). The bigger the workplace, the more important these are:
- Access should be given to named individuals only.
- Account names should be based on individuals’ names.
- Credentials should not be shared.