The riskiest people are the ones you don't employ.
End contractor access with their contract.
The Problem
Contractors, interns, temps, and seasonal staff are usually onboarded and offboarded outside normal hiring processes. This makes them riskier than employees because they are likelier to retain access after their contract ends.
48% of breaches now involve a third party, up from 30% a year earlier.
Separate Rules, Same Process
Klef reads each worker type and assignments start and end dates from your HRIS, so a policy can apply to a worker whether they are a contractor or employee. This allows you to craft policies specifically for contractors or temporary roles.
policy "Contractor access" { category = "Contractors" applies = segment.contractors stage active { target microsoft_entra.user { userPrincipalName = "contractor-{{ worker.display_name | downcase }}@acme.com" displayName = "{{ worker.display_name }} (Contractor)" jobTitle = worker.job.name employeeType = "Contractor" accountEnabled = true groups = ["Contractors"] licenses = [] } target github.member { login = lookup(table.github_usernames, worker.business_email) member = true role = "member" teams = ["contractors"] } target slack.user { userName = worker.business_email displayName = "{{ worker.display_name }} (Contractor)" title = worker.job.name channels = ["contractors"] } } stage departing { notify email { subject = "{{ worker.display_name }}'s contract ends {{ worker.end_date }}" to = [manager(1)] } } stage terminated { target microsoft_entra.user { accountEnabled = false groups = [] } target github.member { member = false teams = [] } target slack.user { active = false channels = [] } }}