3rd Party Contractor Access on Autopilot
23,000 third-party contractors, 13 brands, seven people on the identity team. Twine runs the weekly recertification in Teams, with a manager in control.
Retail runs on people who do not work for you. Vendor merchandisers set the displays, equipment and facilities techs keep the stores running, cleaning crews come in overnight, and distribution-center temps carry the holiday peak. At this retailer there are roughly 23,000 of them, one contractor for every five associates.
Every one of them needs access to do the job, and getting them off that access when the engagement ends is where the risk hides. Managers are quick to onboard a contractor and slow to close them out, so accounts outlive the work. A weekly recertification existed to catch that drift, but with 13 brands each carried their own directory and their own aging contractor system, and the review now meant managers logging into another banner's portal from a back office between shifts.
Why This Matters in Healthcare
- Access outlived the engagement. Contractors kept working access, sometimes privileged, for months after their last shift, because closing them out had no motivated owner.
- Acquisitions multiplied the friction. Recertifying meant hopping across 13 banners' legacy portals. Some managers owned 200 to 300+ contractors and approved on autopilot.
- Seven people against 23,000 contractors. Store count, seasonal peaks, and constant turnover spiked the queue and thinned the expertise to one veteran, with no room to hand-run a chain-wide review every week.
- A two-decade-old system, mid-migration. The contractor system was slated for eventual sunset, but a multi-year identity migration was already underway. They needed relief now, with no rip-and-replace.
The Solution
Alex, Twine's first AI Digital Employee, runs the weekly recertification as a scheduled task: reading who is active, deciding what to recommend, and bringing the decision to the right manager in Microsoft Teams. Reviewers here are store, district, and category managers who spend the day on the floor, not at a desk. They approve or revoke in a chat, from a phone, and never log into the legacy portal again.
Alex writes back to the existing contractor system through scoped, outbound-only access, and stamps every change with an attributable audit entry. No connector to build, nothing to rip out. The value showed up during the pilot, before a purchase order existed.
How it works
- Scope the cycle. Each week Alex reads the active-contractor roster across all 13 brands and the manager and authorizers responsible for each one.
- Enrich and recommend. Alex checks last sign-in against Active Directory and flags a recommendation: extend, or revoke when access has gone stale.
- Reach the reviewer. Alex messages the manager in Teams with the shortlist and its recommendation. Large owners get a guided review instead.
- Act and record. On approval, Alex extends or removes access in the source system and logs an attributable entry naming Alex as the actor.
- Run unattended. The cycle repeats on schedule. The team stops chasing renewals and steps in only on the exceptions.
A manager makes every call
This is human-in-the-loop by design. Alex does the repetitive analysis and the outreach; a manager makes the extend-or-revoke decision. Because a person confirms each action, the reviewer is the last check before access changes.
The logic is transparent and tunable, driven by explicit rules and sign-in signals rather than a black box, and every action lands with an attributable audit record. It runs on top of the systems the retailer already has, with no rip-and-replace.
Why not the incumbent tool, or another in-house build?
The retailer already owned a governance suite and had built its own weekly-renewal portal. Both were part of the problem: the suite struggled with custom and long-tail apps, and the homegrown portal forced cross-banner logins and was slated for sunset.
The bottleneck was never writing the access change. It was the human decision work and the friction around it. Alex closed that gap first, conversationally, with no integration project, and proved it on the retailer's own data during the pilot.
What Alex takes on next
- Manager self-service password reset. Store managers reset their team's passwords in Teams instead of routing every request through the help desk, the next target for deflecting ticket volume in a high-turnover, majority part-time workforce.
- One identity view across banners. Alex correlates accounts across the 13 acquired banners' directories to surface orphaned and duplicate access ahead of the identity migration.
Why Twine Security
- Purpose-built for identity: Not a generic AI assistant. Alex is trained on IAM/IGA workflows, SOPs, and the organization's own knowledge.
- Works with what you have: Integrates with IDPs, IGA, PAM, ticketing, HRIS, and business applications over outbound-only, least-privilege access, rather than replacing them.
- Recognized by analysts: Named a 2025 Gartner Cool Vendor in Identity-First Security.
- Built for control: Human-in-the-loop by default, with attributable audit records for every action Alex takes.