I would most likely be holding the registration info, so it would be me locking him out :-). He will only ever want ftp access to his own site.
But seriously, he is the designer I often use on sites, and a trusted friend, but I'll consider that security aspect of it.
Am I right to assume then, that the master account gets one user/password that lets them in to the control panel, and also for ftp etc. I guess I can always set up a separate ftp for him.
Sounds cheap I guess, but then thats why I'm not looking at $40 hosting. I just don't need another personal domain that I can think of.