Contractor lifecycle
Managing time-bound contractor access with automatic expiry.
This project governs contractors: access is granted with an end date and automatically revoked on expiry, with sponsor re-attestation for extensions.
- Time-bound access with end dates
- Automatic expiry and revocation
- Sponsor re-attestation to extend
- Tighter review than employees
Contractors and other non-permanent workers carry elevated risk: they are temporary, often externally managed, and their access has a nasty habit of outliving their engagement. This project governs contractor access with time-bounds and automatic expiry so access ends by default unless deliberately renewed.
The goal
Contractor access should be granted with an end date and revoked automatically when that date passes, with the sponsoring manager required to re-attest in order to extend it.
How to build it
- Model contractors with an end-date attribute on the identity (fed from the source that manages them).
- Grant access as time-bound, tied to the engagement end date.
- Schedule expiry-driven revocation so access is removed automatically when the date passes.
- Require sponsor re-attestation to extend, no silent rollovers.
- Certify contractor access more frequently than employee access.
Design considerations
The guiding principle is that contractor access should expire by default. Everything is designed so that inaction leads to removal, not continuation, which is the opposite of how access usually behaves. Ensure there is a reliable source for the end date and sponsor, and make extension a conscious, approved act rather than an automatic one.
Common pitfalls
- No reliable end-date source, so expiry cannot fire.
- Silent auto-renewal defeating the time-bound model.
- Treating contractors like employees with the same low review cadence.