Temporary access: how to grant it — and revoke it

A consultant for 6 weeks, a developer brought in just for the migration, a cover during maternity leave. Granting temporary access is easy — revoking it is where things go wrong.

Granting temporary access is easy. Revoking it is where almost every SMB falls short. The consultant who helped out for six weeks in February still has access to your Salesforce come September. That's the pattern.

Four ingredients for a process that actually works

1. End date required at the point of request. No "until we no longer need it" — a date goes into the system.
2. Reminder to the person responsible. Five days before the end date, the internal manager gets an email: "Access X for Y expires on …. Extend or let it lapse?"
3. Automatic revocation on the end date. No manual action required — the tool sets the account to inactive and marks all has_access entries as needs_review.
4. Log as an audit trail. Who was the access requested for, who approved it, how long it was active, when it was actually revoked.

Patterns that work

• Default 30 days. Unless explicitly extended. Do you have to renew every month? Yes. Is that annoying? Yes. Is it effective? Remarkably so.
• Quarterly cleanup of contractors. Even for ongoing engagements: every three months, check with the responsible manager: "Do we still need to renew this one?"
• Separate accounts for external parties. consultant.name@yourcompany.nl, not mixed into your regular employee list. A visual reminder that this access is temporary.

Integration with offboarding

See also the offboarding checklist. For contractors, offboarding is essentially "expires on end date" — the extra consideration is that you also need to arrange a client handover.

Our AccessGuard tool lets you record end dates per person and per individual system; the risk scanner automatically flags temporary access that has expired but is still active.