The engagement was three months and the access was not
Time-boxed work does not automatically produce time-boxed access, and the gap is invisible until it matters.
- The setup
- A contractor brought in for a defined piece of work, needing production-adjacent credentials.
- In play
- Fixed-term engagementScoped accessDefined end date
A contractor needs enough access to do the work and no more, for three months and not four. Both halves of that are usually handled informally, because setting up something rigorous costs more than the engagement seems to justify.
The end date is the part that gets dropped. Accounts get disabled on the last day; credentials that were shared as values do not, because there is nothing to disable.
What breaks
Scoping ends up all-or-nothing
Sharing a folder in a team password manager usually means sharing everything in it. The contractor who needs two providers can read all fifteen.
The last day removes accounts, not keys
Disabling a user account is visible and satisfying and does nothing to a key value that was pasted into a message three months ago.
Nobody rotates afterwards
The correct action — rotate everything the contractor touched — is exactly the deferred-rotation problem, so it does not happen, and access silently persists.
How it works here
Grant per project
Access is granted to the specific project the work needs. There is no folder-shaped over-share, because sharing is not folder-shaped.
Revocation is cryptographic
Removing them rotates the project data-encryption key and re-wraps it for the remaining members. Anything added after that point is unreadable to their existing copy.
They never received the values
What they held was a wrapped key their device could unwrap, not a chat message containing the strings — so removal has something real to act on.
Rotation afterwards is cheap
Where you do decide to rotate at the provider, the vault side is one edit and a regenerated .env, which is what makes it realistic to actually do on the last day.
Closest to your setup?
Install the extension, import an existing .env, and check the fit against your own projects. It works offline and nothing is uploaded unless you sign in.