Documentation

Appearance

Let contractors help without handing them the keys #

A regional contractor needs to diagnose one building controller. A shared SSH key or an OEM administrator account gives them access beyond that maintenance job and makes it difficult to identify who acted. Use an individual account, a role for the work, and a device and network scope for the site.

Solstice Utilities is an illustrative scenario, not a customer result: an OEM works with contractors across several buildings. This procedure describes the access boundary to check before the first visit.

Choose the role and organisation #

Keep OEM engineering in the vendor organisation. For a contractor operating inside a customer-scoped organisation, start with Site Viewer for visibility or Site Operator when the job needs permitted device operations. Do not give a site technician Developer access to the OEM estate.

For an OEM support pod, Support Engineer handles incident and alert triage; it does not grant log search or Remote Shell. Add an Engineering Viewer group for log search, or a tightly scoped Developer group only when engineering operations are actually required. Review the exact grants in Set up roles and Support team access.

Configure and test the site boundary #

  1. Create a contractor group for the maintenance scope. Give it the narrowest role that covers the agreed work.
  2. Set device access tags and network access tags on that group to the assigned site. Avoid the special all-devices and all-networks scopes.
  3. Invite an individual contractor account and add it to the group. Check its primary role and other groups: role grants stack, so an existing broad role can defeat the boundary you intended.
  4. Sign in with a test account with that same role and scope. Confirm the target device is visible and the required operation is permitted. Confirm a device and network outside the assigned site are unavailable.
  5. When interactive access is needed, use Remote Shell or Wormhole rather than opening inbound ports. Authenticate a Wormhole application separately; tunnel routing does not supply its application authentication.

A role decides which actions a person may take. Tags bound the devices and networks on which those actions apply. Neither substitutes for the other.

Review the work and remove access #

Agree the maintenance window and link the external ticket to the device and operator. Afterwards, review the supported access events, incident timeline, job results, and device-side evidence relevant to the work. Verify coverage and retention before treating platform history as an assurance record; it is not a record of every shell command or external action. See Audit trails for support.

At the end of the engagement, remove or deactivate the local account, or make the corresponding change in the identity provider for a directory-managed account. If SSO and SCIM are enabled, change managed membership in that directory. Do not create an unmanaged duplicate to bypass it. Review active sessions and API keys as part of the leaver process, and test that the contractor no longer has the old site's access.