I know this might be a bit subjective, but it's based on this popular question here. Hopefully this is acceptable.
The problem with that question and answer is that I can't send it to my boss and say "See, this guy on the internet agrees with me!".
So, what is a reliable and respected source that clearly explains why you should never give your password to someone, even an IT guy?
In a corporate environment, there are a few places you can look. Company Acceptable Use Policies generally will have a clause saying not to share accounts or disclose passwords. If your company is subject to certain regulations (PCI-DSS, SOC2, HIPAA, etc.) they will have similar requirements.
Because you want to communicate with your boss, there is a non-technical route you can take.
Those regulations and policies are based on the same general principle: liability. This is a legal concept that has to do with the idea that once you share that access (that is what you are giving them) then they are now liable for that access. In this case, you are sharing liability. What happens if the IT guy uses your account to do something illegal? Because it is your name on the account, you are primarily liable for that activity, but if it is a "shared" account, that liability is shared with those who have access to that account (the IT guy or the rest of the company). If it cannot be known who did something, then there are much fewer options to try and correct or remediate problems.
So, you can tell your boss that you simply do not want to share liability with the entire IT staff. Accounts are intended to be personal so that proper attribution can be made, and that lowers the risk for the company.
An authoritative single source for this may be hard to find as it is, ultimately, subjective. However, not sharing credentials is a fundamental expectation of our current computing paradigm. The use of logins and passwords is fundamental to this reality and to step out of this violates that paradigm and every system that has been built around it.
Access Restricted Resources
IT restrictions are similar in intent to a locked file drawer or a bank safe deposit box. It's similar to laws and general expectations regarding opening other people's mail. Sure that hallmark card with a signature isn't sensitive per se, but it has a specific intended audience and access list.
Regardless of the contents and their meaning or value, the items are protected and access has been restricted. Obviously we could argue about value, sensitivity, etc. but that's after the fact.
Impersonation
You don't walk around with your co-worker's name, building access key, or sit at their cubicle. Why would you use their IT resources? All of the issues and concerns of impersonation in a physical setting exist on networks and disks. The impersonation risks are greater given the ability to identify this impersonation is lower and the potential length of impersonation lasts longer with system credentials.
Most Businesses are "at will employers"
As such, and since you are likely accessing their resources, through their systems, your only actual line of legal defense is to quit. The nuances of this, including issues of BYOD is likely out of scope for this site or at least my area of expertise.
The secondary aspect of this though, is that the business already, likely, has access to everything you have or are doing. A good business prompt is risk vs. reward. For no reward you gain significant risk for all parties. The password receiver is now, as noted by schroeder, liable for actions taken under your credentials. You are liable to any actions that anyone using your credentials takes. Who's the next person to get the password? Even if you trust everyone completely, do people make mistakes? How might those impact individuals and the organization?
Additional risk arises as the business is fostering an environment of credential sharing and risks all resources through erosion of basic best practices that counter (spear) phising, social engineering, keylogging, principles of least access, and more. Is the person asking your credential actually tier 1 support? You have nothing of value on your computer, but who in-turn will give "you" their password?
As a final aside, HIPPA/HITECH does not, from my understanding, have specific wording for passwords or password sharing. That's how you make a "good" law though. The ability to meet the numerous data security, segmentation, and auditing requirements is not possible in an environment where credential sharing occurs. When people share passwords then ACLs are meaningless and auditing is essentially forgery of actual access. From my plebeian perspective, this is a violation of federal law.
***Note I speak/write colloquially with "you"s and don't mean to indicate Devil's Advocate but rather any general reader or person this may apply to.
No, there cannot be an authoritative source because the statement is not true. There are times when you should give your password to other people.
There are plenty of scenarios where the benefit of providing your password to someone is greater than the cost of the worst case scenario of providing them your password, and where logging in for them is made impossible within the required timeframe.
To take a trivial example (although there are plenty that could apply to work), a friend staying at your house who wants to watch your netflix while you are at work.
