Third-Party Access Governance: Grouping Identities by Vendor

Third-party access governance works best when every outside identity is tied to the firm that sent it. Contractors, supplier engineers and partner analysts log in to finance platforms, cloud consoles and customer records, yet none of them sit in your HR system, and the vendor relationship is usually the only thing they have in common. Citadel Identity360 can group identities by vendor, so sponsors, reviewers and the team that closes a contract all start from the same view: which people belong to this supplier and what each of them can reach.

Below we cover what vendor grouping changes, what to test in a pilot and how Citadel handles the rest of the lifecycle. For the path of a single contractor from start date to removal, read our walkthrough of contractor lifecycle governance and access removal. To see how outside workers shape a quote, read how contractors are counted in IGA pricing.

Why a List of Names Is Not Enough for Outside Access

Identity programs were designed around employees, with an HR record, a line manager and a termination date. Outside identities fit none of that. A staffing-agency contractor arrives on a purchase order, a supplier engineer logs in only when a ticket demands it, and a partner analyst can keep a reporting login for years.

When these people are governed one by one, three gaps open. Nobody can say quickly how many people a given supplier has inside your estate. Sponsors approve individuals without seeing the wider footprint of the firm behind them. And when a contract ends, someone has to rebuild the list of that supplier’s people from email threads and spreadsheets.

Grouping identities by vendor closes the first gap directly and gives the other two a starting point. The vendor becomes a starting point for governance decisions, not just a field in a procurement system.

Vocabulary for a Vendor-Centred Program

• Third party: any organisation outside your workforce whose people or systems receive access, including staffing agencies, outsourcers, consultancies, software suppliers and business partners.
• Vendor group: the set of identities in Citadel associated with one third-party organisation.
• Sponsor: the named internal person who vouches for an outside identity and answers for it until the engagement ends.
• Engagement window: the start and end dates of the work that justifies the access, recorded where policy can act on them.
• Time-bound grant: an entitlement that carries its own expiry, tied to the engagement window rather than left open.
• Supplier exit: the point at which a contract with a third party ends and every identity linked to that firm must leave.
• Confirmed removal: a fresh check of the target application after the change runs, showing the entitlement is gone.

Selection Criteria This Guide Covers

In scope: vendor grouping; sponsor ownership; onboarding without an HR feed; time-bound grants and extensions; supplier exit; SoD and risk scoring; connector and RPA reach; supplier-built accounts and AI agents; audit evidence; hosting; and included customization.

Out of scope: supplier due diligence questionnaires, contract management, vendor security ratings, remote access gateways and privileged session recording. Each of those belongs to its own buying track.

Vendor Grouping in Citadel Identity360

Citadel Identity360 can group contractor, supplier and partner identities by the vendor they belong to. That one capability changes the context for three recurring decisions.

Ownership at the level of the supplier

Each contractor in Citadel carries a sponsor and engagement dates. With identities grouped by vendor, the people who own the supplier relationship can start from that vendor group to see the identities associated with the firm, rather than piecing them together from individual requests. Citadel also detects accounts without active owners and reports them as orphaned account exposure, so an ownerless supplier identity does not stay hidden.

Reviews with the vendor in view

Starting from the vendor group, sponsors and reviewers can work through each worker’s access knowing which supplier sent them. In certification, Citadel gives reviewers an AI-assisted recommendation and the risk attached to each access item. See AI-assisted access reviews for how outside workers fit into one campaign.

Offboarding that starts from the vendor

When a supplier contract ends, the question shifts from one person to everyone that firm sent. Vendor grouping gives the offboarding team that population inside Citadel instead of a roster rebuilt by hand. Each worker in the group then goes through a governed leaver step, and the Citadel identity graph shows how each grant was given and who approved it.

Lifecycle Controls Behind Each Vendor Group

Grouping pays off only when the lifecycle beneath it is sound. These controls apply to outside identities in any vendor group.

Onboarding outsiders with no HR feed

Outside workers arrive from procurement systems, staffing portals and supplier rosters. Citadel reads them over SCIM, LDAP, JDBC, REST, SOAP, SFTP, flat files and batch, with mainframe and custom integrations for the rest, and routine source setup is no-code-first.

Expiry tied to the engagement

Outside access should end with the engagement, not with a remembered ticket. Contractor access in Citadel follows engagement dates, extensions need fresh approval and validation, and offboarding is part of the lifecycle. Joiner, mover and leaver automation orchestrates provisioning and deprovisioning across applications with and without connectors.

Conflict and risk checks for outsiders

Contractors often collect access across several projects. Citadel watches for toxic segregation of duties combinations in real time and assigns each identity a risk score, together with orphaned account exposure and a permission creep score.

Reaching applications without an API

Many suppliers work inside older applications with no provisioning interface. Citadel adds RPA-based integration to its API, directory, database and file methods, so governance extends to applications run through their user interfaces. Where an action still needs a person, it runs as governed manual fulfilment. Governance without SCIM explains the pattern in detail.

Accounts and Agents a Supplier Leaves Behind

Suppliers leave more than people. Integration accounts and keys an outsourcer created keep working after its team rolls off. Citadel assigns machine identities such as these an accountable owner throughout their life until decommissioning, so a supplier-built integration can be handed to someone inside the business before it is retired.

AI agents reach the Citadel inventory through discovery scoped to the central agent registries of Google Cloud, AWS and Microsoft Entra. With Citadel agent governance, MCP servers and agents receive owners at registration and permission for specific tools, and a kill switch provides intervention and containment for an agent that misbehaves. Citadel generates a config file that Claude, OpenAI and Cursor MCP clients use for governed MCP access. Our overview of NHI governance tools covers this in more depth.

Proof for the Third-Party Risk Team

The NIST CSF treats supply chain risk as a governance outcome, and the NIST SP 800-53 personnel and account controls ask organisations to set requirements for provider staff and manage accounts across their whole life. NIST SP 800-161 adds supply chain risk management practices your third-party risk team can use as a reference.

Citadel collects audit evidence automatically while campaigns and policy checks run, shows the path behind each grant together with its approver, and produces audit-ready reports with a one-click export. Removal is proven only when the target confirms it; our piece on tracking revocations after a review separates a closed task from a confirmed result.

Vendor-Level Questions and Where Citadel Answers Them

Six questions come up for every supplier. Here is where Citadel answers each one.

• Who is here? Identities grouped by vendor.
• Who owns it? A sponsor and engagement dates for each contractor.
• When does it end? Access follows the engagement dates.
• Is it risky? SoD conflict checks and a risk score for each identity.
• How was it granted? The identity graph, with the approver behind each grant.
• Is it gone? A governed leaver step for each worker, then a check of the target.

A Pilot Checklist for Third-Party Access Governance

Run each test below in a Citadel pilot with your own data, and put the same question to every platform you evaluate.

• Vendor grouping. Citadel groups outside identities by vendor. Test: load workers from two suppliers and open each vendor group. Ask: can you show every identity one supplier has in our estate?
• Sponsor handover. Citadel records a sponsor per contractor and detects accounts without active owners. Test: remove a sponsor and trace their sponsored identities. Ask: what happens when a sponsor leaves?
• Onboarding without HR. Citadel takes directory, database, API and file sources with no-code-first setup. Test: onboard one worker from a file you supply. Ask: which sources create an outside identity without engineering?
• Expiry and extension. Citadel ties access to engagement dates and requires fresh approval for extensions. Test: extend one engagement and let another lapse. Ask: does an extension force a new decision?
• Supplier exit. Citadel starts from the vendor group and runs a governed leaver step for each worker. Test: close one supplier and follow every worker through removal. Ask: how is each removal confirmed?
• No-API applications. Citadel adds RPA and governed manual fulfilment to its connectors. Test: revoke a grant in a legacy tool that lacks an API. Ask: how is that removal carried out?
• Tailoring and hosting. Citadel comes with 400 hours of customization within the agreed scope and runs on-prem, in private cloud or SaaS. Test: map one vendor workflow you need tailored. Ask: what tailoring comes with the plan?

Citadel Identity360 Across the Supplier Relationship

Citadel governs the identities an outside relationship creates, from the contractor and partner analyst to the integration account and agent. Vendor grouping keeps each supplier’s people together; sponsors, engagement dates, risk scores and the identity graph ground each decision.

Day-to-day configuration is no-code-first, so the IAM team maintains sponsor rules, expiry policies and approval chains itself, with engineers reserved for specialised integrations. An unusual roster format or a procurement approval path can draw on the 400 hours of customization in the Citadel plan, within the agreed scope. Regulated programs can host Citadel on-prem or in their own private cloud and own the upgrade change window; others choose SaaS, where Astranova runs releases. The hybrid enterprise buyer guide places third-party governance inside a wider estate.

Illustrative Example: Closing Out a Facilities Supplier

This scenario is illustrative, not a customer result. A facilities firm reaches the end of its contract; several of its staff hold access, and it built two integration accounts.

1. The offboarding team opens the vendor group for the firm in Citadel and sees the identities associated with it.
2. For each worker, the identity graph shows accounts and entitlements, including access to a legacy work-order application, with the approver behind each grant.
3. Leaver workflows remove access through connectors where an API exists and through an RPA workflow on the legacy application.
4. The two integration accounts move to a named internal owner for a dependency check before retirement, rather than being deleted blind.
5. The team checks each target before treating an item as closed, and any exception goes to an administrator as governed manual fulfilment.
6. The third-party risk team exports the Citadel audit evidence for the leaver steps and attaches its own target checks.

Buyer Questions on Governing Vendor Access

Can Citadel Identity360 group identities by vendor?

Yes. Citadel can group contractor, supplier and partner identities by the vendor they belong to, so ownership, review and offboarding start from the vendor group rather than a list of individual names, with leaver steps still run for each worker.

How should outside workers be governed without an HR record?

Give every outside identity a sponsor and an engagement window drawn from procurement, staffing or roster sources. Citadel brings those sources into its identity graph and lets engagement dates drive provisioning, extensions and offboarding.

Who is the right sponsor for a supplier engineer?

The internal lead who benefits from the work and can judge whether the access is still needed. Citadel records the sponsor with the engagement dates, and extensions return for fresh approval.

How should a supplier exit run from start to finish?

Start from the vendor group, take every worker through a governed leaver step and confirm each removal in the target. Citadel shows each grant and its approver and collects the evidence automatically.

Does one platform cover outside people, supplier integrations and AI agents?

Yes. Citadel governs outside workers, supplier-built integration accounts, keys and AI agents in one product, with agent discovery scoped to the central registries of Google Cloud, AWS and Microsoft Entra.

Is customization for supplier workflows part of the Citadel plan?

Yes. Citadel carries 400 hours of customization, within the agreed scope, for roster formats, approval logic, reports and integration changes.

Watch Citadel Close Out One of Your Suppliers

Bring one real supplier relationship: its roster, its sponsors and the hardest application its people use. We will group the identities by vendor, run sponsor review and expiry, and take each worker through a leaver step, and your team can check the targets itself. Request Demo to book the session, and preview the console first on the Citadel Identity360 video page.