Sharing a password is the wrong way to do this, and it is what most small businesses end up doing. It means you cannot tell who changed what, you cannot remove one person without changing it for everybody, and your own account is exposed.
Adding somebody properly takes a minute. They make their own login, they see your site in their dashboard, and you can remove them whenever you like. If they make a mess, History shows what happened and any earlier version can come back.
Step by step
In your dashboard, open Set-up and find the people section.
Enter their email and add them.
They get an email, make their own login, and see your site.
Remove them at any time from the same place.
If it does not go to plan
What can they do?
Edit and publish the site. Only an owner can change billing or connect a web address.
They already have a Kitset account.
That is fine. Your site appears in their list alongside anything else they work on.