Contractor access without orphaned cards: a practical checklist

The most common access-control failure is not a breach — it is a contractor card that was never returned. Here is a short checklist to keep temporary access temporary.

Before the first day

• Create a contractor role with only the zones the job needs
• Set a validity window that matches the contract — not "permanent"
• Require a sponsoring host on the record for every contractor

On site

• Issue card, QR, or face credentials that expire automatically
• Tie every entry to the contractor identity and their host
• Let attempts outside the assigned zone or window be denied and logged

When the job closes

• Let access expire on schedule, or revoke it in one action
• Keep the full entry history for compliance and incident review
• Review who still has active credentials at a glance

Each of these maps to a capability in Duall Master's contractor access management — no spreadsheets, no orphaned cards.