Third parties, constrained by design
Give providers enough authority to deliver—not a blank cheque.
Describe what an accountant, claims handler or managed-service provider may do for each client organisation, with resource and delegation limits.
The authority gap
Supplier access is often broad while the underlying client instruction remains buried in contracts, email or onboarding paperwork.
EXAMPLE MANDATEPermitted
- Principal
- Aster Labs SAS
- Representative
- Ledger & Co LLP
- Action
- File VAT return
- Resource
- French tax account
- Limit
- Filing only; no payment
- Condition
- No delegation
What changes
Move from implicit permission to explicit policy.
- Separate system access from authority to perform a client act.
- Apply explicit exclusions and maximum delegation depth.
- End authority cleanly when the engagement changes.
Related authority patterns
The actor changes. The verification discipline remains.
Design-partner programme
Test a real external accountant authority workflow.
We will map the principal, representative, action, resource, policy and relying-party decision with your legal, security and operational stakeholders.