Inviting a vendor and granting access
Two separate decisions: who the person is (an invitation, answered with a passkey) and what they may reach, for how long (a grant). Neither alone opens anything.
1Invite the user
Open People → Invites and enter the person's e-mail address. Pick a role:
- Vendor for an outside supplier.
- Staff for your own employee. The access is identical (connect-only); the label is what differs, and it shows next to the Company column in the audit log so internal and external access can be told apart at a glance.
If SMTP is configured under Infrastructure → Email and ticked Enabled, the invitation is mailed. If not, copy the one-time invite link from the Invites screen and send it yourself. The link expires after the Invitation link lifetime set in Policy.
2Grant access
Open Access → New grant, choose the user and the resource. Then decide the shape of the access:
- Start and end: a time window. Leave both empty for permanent access, unless Policy sets a Maximum grant duration, in which case every grant must carry an end.
- Require approval: the grant exists but stays pending until an Operator or Admin approves it.
- Weekly schedule: restrict the window to recurring hours, for example weekdays 09:00–18:00, evaluated in the time zone you pick. Outside those hours the request is refused with the reason "outside hours".
A grant an admin creates is active immediately. Every request the vendor later makes is checked against it: the window, the schedule, the approval state. When the window closes the access ends on its own; nobody has to remember to revoke it.
From Access you can also extend a grant, revoke it early, or terminate a session that is running on it right now; revoking ends the live session too.
3The vendor enrolls and connects
The vendor opens the invitation link and registers a passkey: Touch ID, Windows Hello, a phone or a hardware key. There is no password to set and none to share later. We recommend they register a second passkey on another device straight away, so losing a laptop is not losing the account.
Then they open the resource's public address, for example wiki.<your-org>.cloud.captivo.io, sign in once with the passkey and land on the app. Remote desktops and isolated browsers open as a live screen in the same tab. Every request is checked against the grant and written to the audit log. Sign-in trouble is covered in cannot sign in with a passkey; the mechanics of passkeys, SSO and recovery in identity.
Access requests and approval
Access does not have to start from the admin. A vendor can ask for a resource from their own portal; the request is created pending, which means refused until someone approves it. Policy can require a written justification with every request.
Operators and Admins see the queue under Access → Pending requests, with the requested window and the justification, and Approve or Deny each one. The requester is told of the outcome by e-mail when SMTP is set up, and by an in-console notification in any case.
The vendor portal
A vendor or staff user who signs in at the console address does not see the console. They see a small portal with four tabs:
| Tab | What it shows |
|---|---|
| My access | Grants that are active now and ones that start later, each with a connect button. |
| Requests | New access requests and the state of earlier ones. |
| History | Past grants and requests. |
| Preferences | The display time zone, overriding the organisation default. |
Roles
Five fixed roles. Assign the least one that fits. Roles govern the console only: reaching an app is always decided by a grant, and an Admin without a grant for a resource cannot open it either.
| Role | Can do | Typical use |
|---|---|---|
| Admin | Everything: connectors, resources, people, invites, policy, e-mail, sessions, grants, audit. | The operators running the deployment. |
| Operator | Create, approve, deny and revoke grants; view the console. | Day-to-day approvers, help desk. |
| Auditor | Read-only console: audit log with CSV export, resources, grants, recordings. No changes. | Compliance and security reviewers. |
| Staff | Connect only; internal identity. | Your own employees. |
| Vendor | Connect only. | External suppliers. |
For product-wide problems: The connector shows offline · The app does not open · Cannot sign in with a passkey