Trusted on behalf-of access, auditable every step.
When partners, consultants, or services need to act for your organization—bind their identity to bounded authority. Evaluate every action. Revoke instantly. Preserve complete evidence.
How it works
Talk to an expert
Legacy vs. delegated access
Legacy “Standing Access”
- ✕Third party gets broad credentials
- ✕Access granted indefinitely
- ✕No explicit scope or purpose
- ✕Hard to revoke (account still active)
- ✕Audit trail opaque (service account logs)
- ✕Compliance risk (standing authority)
Delegated Access
- ✓Verified actor identity (credential)
- ✓Time-bounded grant (e.g., 90 days)
- ✓Explicit scope and purpose statement
- ✓Revocable at any moment
- ✓Complete audit trail (who did what, why)
- ✓Compliance-ready evidence
Scope anatomy: What can the recipient do?
1. Resource Boundary
Which resources? Example: "Project X data in S3 bucket." Not all company data.
2. Action Limit
Which actions? Example: "Read and download. Cannot delete or modify."
3. Volume Cap
How much? Example: "Max 10 GB per day. Cannot bulk export."
4. Time Window
When? Example: "January 1–31, 2026 only. Not renewable."
5. Purpose Statement
Why? Example: "Quarterly audit of vendor invoices. No other use."
Scope is NOT permission: Scope defines the boundary. Permission is the decision made at request time by policy engine. The recipient cannot act outside scope, and policy can further restrict inside scope.
The actor and relationship model
Three actors. One mandate. One decision at a time.
Principal (Your Organization)
The organization that owns resources and grants authority. Sets policy. Revokes access. Owns audit trail.
Delegator (Manager)
Authenticated person from principal organization who decides to grant access. Creates and signs the delegation mandate.
Recipient (External Actor)
Third-party person, service, or AI agent that needs to act on behalf of the principal. Gets verified credential.
The arrow: Delegator → (creates) → Mandate → (grants to) → Recipient. At every action, Principal policy evaluates: Is recipient credential valid? Is mandate still active? Does action fit scope?
Authority creation and review
Five steps to delegation
- 1
Identify recipient: Name, email, external org. Verify you're granting to the right party.
- 2
Define scope: Resources, actions, volume, time. Be explicit.
- 3
Add purpose: Why does this party need access? Example: "Q4 security audit."
- 4
Set expiry: Fixed end date. No perpetual access. No auto-renewal.
- 5
Delegator sign-off: Authorized person confirms and digitally signs. Audit trail records who approved.
Result: Immutable mandate recorded. Recipient gets credential. System ready to evaluate their actions.
Action-level decision flow
Every request from a delegated recipient is evaluated in real time.
Request
Recipient asks to access resource
Verify Identity
Is credential valid?
Check Mandate
Is grant still active?
Evaluate Scope
Does action fit scope?
Apply Policy
Org rules, risk check?
ALLOW / DENY
Decision logged
Scenario 1: External consultant
The situation
Jones, Inc. hires Expert Consulting to run a security audit. The auditor needs to read logs and pull compliance reports—but only from compliance-related systems, only for 30 days.
The delegation mandate:
- Recipient: Expert Consulting (org) + [email protected]
- Resources: Compliance logs, audit reports (not financial data)
- Actions: Read, download, analyze (no delete, no export outside scope)
- Time: Jan 1–30, 2026 (30 days, not renewable)
- Purpose: Security audit per engagement SOW
- Delegator: Chief Compliance Officer signs off
Auditor logs in with their credential. System verifies identity, checks mandate, confirms scope. Jan 31, midnight: access revoked automatically. No manual cleanup needed.
Scenario 2: Third-party data pipeline service
The situation
Retailer Corp uses DataFlow Inc.'s cloud ETL service to pull daily sales data, transform it, and load it into BI platform. DataFlow's service needs read access to sales database and write access to the staging warehouse.
The delegation mandate:
- Recipient: DataFlow Inc. (service account, API key)
- Resources: Sales DB (read only) + staging warehouse (write only)
- Actions: Extract data, load transformed data (no delete, no access to other DBs)
- Time: Jan 1, 2026 – Dec 31, 2027 (2 years, auto-review at 12 months)
- Purpose: Daily ETL pipeline per data partnership agreement
- Delegator: VP Data signed off
DataFlow's service authenticates each morning. System verifies service credential, checks mandate (still active, scope matches). Runs pipeline. Logs each data read/write. If DataFlow's mandate is revoked (e.g., contract ends early), next run fails with 403 Forbidden.
Continuous trust and change propagation
Credential Refresh
Every request, verify recipient credential is still valid. Revoked? Expired? Deny immediately.
Mandate Expiry
Time boundary reached. Access revoked automatically. No extension without new mandate.
Policy Change
Principal's policy updated. All delegated recipients re-evaluated. Can deny mid-workflow.
Risk Signal
Anomaly detected in recipient's behavior. Policy engine can throttle or block.
Revocation and immediate access denial
Manual Revocation
Delegator withdraws mandate immediately. No notice period. Next request: 403 Forbidden. In-flight requests get error on next auth check.
Automatic Expiry
Time boundary reached. System automatically expires mandate. Recipient not notified; access simply stops working.
Policy-Driven Revocation
Principal's risk policy triggers. All recipients matching condition are revoked instantly (e.g., "Revoke all external access if breach detected").
Audit trail: “Mandate revoked by [who] at [time] reason [policy_code | manual | expiry]”. All evidence logged. Regulators can see the chain.
Complete audit evidence
Every delegated action is logged with full context:
Recipient Identity
Who made the request (verified credential + org)
Mandate Reference
Which delegation was checked and its status
Delegator & Approval
Who authorized the delegation and when
Action & Resource
What was requested on what resource
Scope & Evaluation
Does action fit mandate scope? Policy applied?
Decision & Timestamp
Allow or deny, when, with cryptographic signature (non-repudiation)
Export-Ready: Evidence can be extracted in compliance formats (SOC 2, ISO 27001, HIPAA). Regulators can inspect who did what, when, and under whose delegation.
Enterprise adoption patterns
Consulting & Audits
Third-party auditors, consultants, tax advisors need temporary, scoped access to specific data. Time-limited, auto-revoke at project end. Compliance teams love the audit trail.
SaaS Integrations
Your CRM, HR, payroll platforms need API access to your data warehouse. Delegated access with clear scope (e.g., "read payroll, write to consolidation DB"). Easy to revoke if vendor contract ends.
Incident Response
When breach occurs, grant forensics team access to logs, databases (limited scope, fixed time). Revoke everything at once. Evidence preserved for post-mortem.
Governance principles
The principle: Third-party access is always temporary, always scoped, always approved, always logged. No assumptions. No “just trust them.” Explicit mandate, continuous verification, immediate revocation.
Frequently asked questions
Can we just use our SSO provider to grant external access?+
SSO only establishes who an external actor is at login; it doesn't bound what resources they can touch, enforce time-limits, or continuously re-evaluate permissions when project scopes change. Zoiko iD provides the granular mandate, real-time scope enforcement, and instant revocation layer on top of any IdP.
Can a third party request their own access?+
Third parties can initiate an access request, but the mandate must be explicitly scoped, reviewed, and cryptographically signed off by an authorized internal delegator before any credentials or tokens are issued.
What if the third party's organization is compromised?+
Because access is strictly bounded by explicit scope, rate limits, and time windows, the blast radius is minimal. Furthermore, any anomaly or risk signal automatically suspends or revokes the mandate immediately across all systems.
How does this work with our identity provider (Okta, Azure AD)?+
Zoiko iD integrates directly with enterprise identity providers via standard protocols (OIDC, SAML, SCIM). External users authenticate through their federated credentials or verified credentials, while Zoiko iD evaluates mandates and enforces runtime authorization.
Can a third party delegate their access to someone else?+
By default, third-party mandates cannot be sub-delegated. If sub-delegation is explicitly required by contract, it must be pre-approved in the original mandate policy and bounded within strict hierarchical constraints.
Ready to secure third-party access?
Whether you're onboarding consultants, integrating SaaS services, or responding to incidents—bind identity to authority. Evaluate every action. Revoke instantly. Preserve the evidence.
Talk to our team
View implementation guide