Temporary access needs an owner and an end point
A contractor or visitor access plan should answer who approved the visit, what work or purpose is expected, which areas are allowed, who is responsible onsite, what credential is issued, and when access ends. Reception alone is not a control if staff cannot tell whether the visit is expected.
Separate public, staff, controlled, and hazardous areas
Map the site by business function rather than treating every nonpublic room the same. A delivery driver may need the receiving point, a repair technician may need equipment access, and an auditor may need supervised records access. None of those purposes automatically requires unrestricted movement through staff, cash, customer-data, storage, or safety-critical areas.
Give the host a clear duty
The host confirms the person, explains relevant site rules, manages keys or badges, and closes the visit. When an escort is required, define who can provide it and what happens when the host becomes unavailable.
Use minimum necessary records
- Name or company information needed to verify the visit.
- Host, purpose, arrival, departure, and credential number where applicable.
- Areas or systems approved for the task.
- Exceptions, incidents, or items that require follow-up.
Do not collect identity documents or personal details merely because a form has space. Set retention and access rules for visitor records. Privacy, contractual, and local requirements may apply.
Close access when the work ends
Recover temporary keys, cards, parking credentials, codes, and shared files. Confirm that doors, panels, alarms, and equipment are returned to the agreed state. If access continues across days, review it rather than leaving a credential active indefinitely.
The employee access offboarding guide covers permanent role changes. The incident documentation log provides a factual record when a visit does not match the plan.