Bringing in an outside contractor: a one-page onboarding pack for access, contacts and handover

A contractor starts on Monday. By Tuesday they are using a colleague's login, because the right account was not ready. By the end of the month nobody remembers which folders they can open, who they report to, or what happens to their files when the job ends. Most of this is not bad faith. It is the lack of a simple page that everyone read on day one.

This article is for the owner or operations lead of a small company who brings in freelancers, agencies or temporary specialists a few times a year and wants a repeatable way to do it.

One page, five parts

The pack fits on a single page, so that people actually read it. It answers five questions: who to ask, what the contractor may open, what they may do with data, how you will check in, and how the work ends.

Write it before the first day and send it with the agreement. Keep one copy with the contract and one where the team can see it.

1. A contact and an owner

Two people, with names and phone numbers:

• Contact: the person the contractor writes to with everyday questions. They answer within a working day.
• Owner of the work: the person who accepts the result and decides when the job changes. This is often the same person in a small company, but write the name anyway.

Add what to do when both are away: a third name, or "wait and write to the owner". A contractor who cannot reach anyone either stops or guesses, and guessing is where mistakes start.

2. Access made to measure

List each system the contractor needs and, for each, the minimum level of access. For example: read-only access to the shared project folder, an account in the project board, no access to accounting.

• Create named accounts for the contractor. A borrowed login of an employee hides who did what and cannot be removed without disturbing that employee.
• Use the lowest level that lets the work be done, and raise it only when the owner agrees to a specific request.
• Put an end date on every access. If the job is extended, the date is extended on purpose.
• Prefer a separate folder to opening a large one. Copying five files is cheaper than explaining why someone could see five hundred.

If the contractor will use automated tools or AI agents on your systems, the same thinking applies. Least-privilege access for AI agents describes how to separate read and write rights and review them regularly; the approach works equally well for people.

3. Rules for data

Three short lines are enough:

• May see: which kinds of data, for example product documents and anonymised orders.
• May not see or copy: for example customer lists, personal data of employees, bank details.
• May keep after the job: usually nothing except their own working notes. If you agree to something else, name it.

Also say where work may be stored. "Only in the shared folder, not on private email or a personal cloud drive" removes a lot of later questions. If personal data is involved, check with whoever handles data protection in your company before the contractor starts, and make sure the agreement covers it.

4. A weekly check

Fifteen minutes once a week, by call or in writing, with the same three questions:

1. What was done and what is next?
2. What access or information is missing, or no longer needed?
3. Is anything different from the plan, in scope, deadline or cost?

Question two is the quiet one that matters. Access that was needed in week one is often unnecessary in week three, and the weekly check is the natural moment to remove it. Keep a one-line note of each check, so the record exists without extra effort.

5. Handover and removal at the end

Decide on day one what "finished" means. A sound ending has four steps:

1. Delivery: the contractor hands over the result and working files in the agreed place, with a short note on how to use them.
2. Acceptance: the owner confirms in writing that the result is accepted, or lists what is missing.
3. Removal: the contact removes every access on the list, one by one, and ticks them off. Accounts, shared folders, tool invitations, keys and passwords the contractor knew.
4. Confirmation: the contractor confirms that they deleted or returned company data as agreed.

Do the removal on the day of acceptance, not "later". Forgotten access is the most common leftover from a finished job, and it costs nothing to avoid.

Common mistakes

• Sharing an employee's login because the proper account is not ready. Delay the start by a day instead.
• Access with no end date. It outlives the job by years.
• Nobody owns the result. Several people comment, no one accepts, and the job never formally ends.
• Data rules left to common sense. What is obvious to you is not obvious to a newcomer.
• Skipping the check when things go well. That is exactly when access quietly grows.

A short plan for this week

1. Write the five parts on one page, using your next or current contractor as the example.
2. List their access today and mark what the task does not need.
3. Set end dates for every access that has none.
4. Book the weekly check in the calendar.
5. Write the removal list now, so it is ready on the last day.

You do not need special software. A page, a few named accounts and a habit of checking once a week are enough to make bringing in outside help calm and predictable.

Sources

• Practical guidance based on common small-business operations practice, offered as a planning aid. The levels of access, rhythm of checks and handover steps are illustrations to adapt to your own company, contracts and legal requirements. No client results or performance figures are claimed in this article.