Give contractors the right access, only for as long as they need it
A temporary contractor access with Bastigo is a named intervention, limited to the servers concerned, logged from the first login to the end of the access, with no permanent VPN and no shared admin account.
Why avoid standing access?
For a two-hour contractor job, many companies open an access that lasts for months instead.
Permanent VPN
A broad network access, still open long after the intervention ended, simply because no one thought to close it.
Shared admin accounts
The same credential used by several contractors, with no way to know who actually did what.
Little time control
Nothing cuts the access automatically: its real duration depends on someone remembering to revoke it.
Limited traceability
After an incident, there's no precise way to know what was done, when, and by whom.
How Bastigo frames an intervention
Who is intervening, on which resources, and for how long: the three questions an intervention answers before the session even begins.
| Criteria | Today (VPN) | With a Bastigo intervention |
|---|---|---|
| Network access | VPN open to the internal network | ✓ Connects through the bastion, no open network tunnel |
| Account used | Standard admin account, often shared | ✓ Named account, tied to the intervention and to MFA |
| Access duration | Standing, revoked manually | ✓ Temporary, expires on its own at the set deadline |
| Traceability | Limited, rarely reviewed | ✓ Session recorded, replayable, and audited |
What an intervention defines
The resources
A specific target and account, with a given protocol (SSH or RDP): the contractor only reaches what is listed in their intervention, nothing more.
The duration
From 30 minutes to 7 days, set at creation by a manager or super admin. Never self-service.
Traceability
Every session opened under an intervention is recorded, and every grant or revocation is logged in the audit trail with the identity of who granted it.
Supervision
An administrator can watch the intervention unfold in real time, read-only, exactly as they would for a session opened through a standing policy.
Cutting the session
If something looks wrong, the session is interrupted immediately from the admin console, with no physical intervention on the network.
Expiration
Once the set duration elapses, access stops working on its own. It can also be revoked before the deadline, in one click.
What IT teams ask about interventions
What is an intervention in Bastigo?
An intervention is a named operation (a maintenance task, an on-call shift, a vendor intervention, an incident) tied to a temporary access policy: access to a specific target and account, for a duration set at creation, from 30 minutes to 7 days.
Can I grant a contractor temporary access?
Yes. A contractor authenticates with MFA, then receives access, via an intervention, to the servers listed, for the fixed duration. They never need a permanent VPN, a shared admin account, or the target account's real password.
Can I limit a contractor to specific servers?
Yes, an intervention is always created for a specific target and account, with a given protocol (SSH or RDP). The contractor only accesses that resource, never the rest of the infrastructure.
Can I supervise an ongoing intervention?
Yes, an authorized administrator can watch an active session in real time, read-only, whether it was opened through a temporary intervention or a standing policy.
Can I interrupt a session in progress?
Yes, an administrator can cut a session immediately from the console, with no need to physically unplug anything.
Is an intervention's session recorded?
Yes. An intervention opens an SSH or RDP session like any other: it is recorded automatically and replayable from the admin portal.
Can an intervention's access expire automatically?
Yes, that is the whole point of an intervention: once the duration set at creation (30 minutes to 7 days) elapses, access stops working with no administrator having to think about it. It can also be revoked earlier, in one click.
Does Bastigo replace a VPN for contractors?
Bastigo replaces the riskiest use of a VPN for a contractor: a broad, permanent network access for a one-off job. With Bastigo, the contractor goes through the bastion, with access limited to what they need for exactly as long as they need it, session logged and supervisable.
Is Bastigo a PAM?
Yes: SSH/RDP gateway, password vault, session recording, access policies, audit. See the features page for the full detail.
What is the difference between a standing policy and an intervention?
Both rely on the same policy engine. A standing policy stays active until an administrator removes it. An intervention is a temporary policy: it carries a name (the operation it covers) and a duration, and stops working on its own once that duration elapses.
Interventions, in context
See an intervention unfold, in real conditions
Thirty minutes is enough to walk you through the whole flow, from granting access to it expiring.