Contractor lifecycle
Quick answer
This project governs contractors: access is granted with an end date and automatically revoked on expiry, with sponsor re-attestation for extensions.
Key takeaways
- Time-bound access with end dates
- Automatic expiry and revocation
- Sponsor re-attestation to extend
- Tighter review than employees
Contractors and other non-permanent workers carry elevated risk: they are temporary, often externally managed, and their access has a nasty habit of outliving their engagement. This project governs contractor access with time-bounds and automatic expiry so access ends by default unless deliberately renewed.
The goal
Contractor access should be granted with an end date and revoked automatically when that date passes, with the sponsoring manager required to re-attest in order to extend it.
How to build it
- Model contractors with an end-date attribute on the identity (fed from the source that manages them).
- Grant access as time-bound, tied to the engagement end date.
- Schedule expiry-driven revocation so access is removed automatically when the date passes.
- Require sponsor re-attestation to extend, no silent rollovers.
- Certify contractor access more frequently than employee access.
Design considerations
The guiding principle is that contractor access should expire by default. Everything is designed so that inaction leads to removal, not continuation, which is the opposite of how access usually behaves. Ensure there is a reliable source for the end date and sponsor, and make extension a conscious, approved act rather than an automatic one.
Common pitfalls
- No reliable end-date source, so expiry cannot fire.
- Silent auto-renewal defeating the time-bound model.
- Treating contractors like employees with the same low review cadence.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
What makes contractor access special?
- A. Contractors are temporary and externally managed.
- B. It is time-bound and expires automatically unless renewed.
- C. The contractor's sponsor via re-attestation.
Show answer
B. It is time-bound and expires automatically unless renewed.
It is time-bound and expires automatically unless renewed.
Who approves an extension?
- A. It is time-bound and expires automatically unless renewed.
- B. The contractor's sponsor via re-attestation.
- C. Contractors are temporary and externally managed.
Show answer
B. The contractor's sponsor via re-attestation.
The contractor's sponsor via re-attestation.
Why higher risk?
- A. It is time-bound and expires automatically unless renewed.
- B. The contractor's sponsor via re-attestation.
- C. Contractors are temporary and externally managed.
Show answer
C. Contractors are temporary and externally managed.
Contractors are temporary and externally managed.