# Third-party access control: leave the gatehouse sheet

> How to move third-party access control off the gatehouse spreadsheet, with a contractor release checklist from registration to exit.

Author: José Carlos Maciel, Founder and developer. Published 2026-10-16, updated 2026-10-16.
Source: https://boosting.tech/en/blog/third-party-access-control/

**Quick answer:** Third-party access control registers, approves, releases and records entry and exit for contractors, visitors and vehicles at a site. The system takes the company request, checks documents, routes approval, issues a QR badge and lets the gatehouse validate access, with a history for audit.

It is eight in the morning at the gate. A maintenance technician arrives in the contractor's van, the gatehouse opens the day's spreadsheet and the name is not on the list. Someone approved by email last night, the message sat in someone else's inbox, and the truck that was meant to come with him is already in the queue. Meanwhile nobody is sure how many contractors are still inside the site.

This article explains what third-party access control is, why the gatehouse spreadsheet stops working when volume grows, and how to organise release from registration to exit. In the middle is a concrete checklist to specify or assess your flow. If you are still deciding between off-the-shelf software and a system built for your process, start with our article on [custom software vs. off-the-shelf](/en/blog/custom-software-vs-off-the-shelf/).

## What is third-party access control?

Third-party access control is the set of steps that authorises and records entry and exit for people and vehicles who are not permanent site staff: contractors, visitors, drivers and teams from tenant or contracted companies. The company that requests access, the manager who approves, the gatehouse that checks and the administration that tracks occupancy all take part.

The typical flow starts with a request: who is coming, from which company, to which area, on which date and with which vehicle. Then come document and training checks, approval, issue of a badge or credential, and gatehouse recording on entry and exit.

At industrial and port sites, this control connects to risk prevention. Brazil's [NR-01](https://www.gov.br/trabalho-e-emprego/pt-br/acesso-a-informacao/participacao-social/conselhos-e-orgaos-colegiados/comissao-tripartite-partitaria-permanente/normas-regulamentadora/normas-regulamentadoras-vigentes/nr-01-atualizada-2024.pdf), the Ministry of Labour and Employment standard on occupational risk management (Gerenciamento de Riscos Ocupacionais), asks organisations to treat risks with concrete information. Knowing who is in a risk area, from which company and with which authorisation supports that work. [NR-23](https://www.gov.br/trabalho-e-emprego/pt-br/acesso-a-informacao/participacao-social/conselhos-e-orgaos-colegiados/comissao-tripartite-partitaria-permanente/arquivos/normas-regulamentadoras/nr-23-atualizada-2022.pdf), on fire protection, requires workers to be informed about emergency response and evacuation procedures and requires emergency exits to remain usable. Knowing who is on site when an alarm sounds supports evacuation readiness. Neither standard mandates a specific software product; what they ask for is organisation and information. The official texts are in Portuguese.

## Why does the gatehouse spreadsheet stop working?

Spreadsheets and email work while few companies request access and one person updates the list calmly. When dozens of contractors arrive on the same shift, each with a different document expiry, control depends on whoever remembered to refresh the file.

In the access-control projects we have built for industrial complexes, the starting point often looked the same. The most common problems were these:

- The gatehouse list is out of date compared with the last approval email.
- Anyone with the spreadsheet link can change or delete another company's row.
- Documents and training are checked by hand, when they are checked at all.
- Exit is not recorded with the same discipline as entry.
- In an audit or emergency, building the list of who is inside takes too long.
- Contractors' personal data is visible to people who do not need to see it.

Brazil's LGPD (Lei Geral de Proteção de Dados Pessoais) is another issue. Name, ID document and photo of a visitor or contractor are personal data. The [LGPD](https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm) asks for a clear purpose, security measures and care with retention. An open spreadsheet with hundreds of rows rarely meets that. A system with a login per company and a change log solves a large part of the problem in the design itself.

Search queries such as "access control" and "gatehouse access control" show up with some frequency for teams at industrial and port sites. What those teams are looking for, in practice, is to leave the printed list and have a reliable check at the moment of entry.

## What is in scope and what stays out?

The system must control the request, the person, the approval and what happens at the gatehouse. Each part has its own rules, and the value is in checking all of them before release.

| Element | What to control | What happens without control |
| --- | --- | --- |
| Access request | Requesting company, area, date, time and reason | Gatehouse decides on the spot |
| Contractor or visitor | Register, documents and training with expiry | Person turned away or released without a check |
| Vehicle | Plate, type and link to the request | Truck in the queue without clear authorisation |
| Approval | Responsible manager, decision and reason | Lost email and an outdated list |
| Gatehouse | Entry, exit, released area and badge validity | Nobody knows who is still on site |

What usually stays out of the first scope is advanced biometrics, full integration with every turnstile model and fine-grained control of internal zones beyond the main gate. Those features are useful and can come later, once the basics run and the team trusts the record. In the [industrial access control case](/en/case-studies/industrial-access-control/) we published, the system covers scheduling, approval, QR badge, gatehouse, site occupancy and access-equipment status, evolving since 2023.

## Checklist: how do you release a contractor from registration to exit?

The checklist below gathers what we have seen work in the release flows we maintain, in concrete checks from registration to exit. Use it to write the process for a new system and to assess what you already use, whether spreadsheet or software.

### Checklist for releasing a contractor

Use this to release a contractor from registration to exit, or to assess the spreadsheet and flow you use today. Required documents vary by company and by risk area, so review the list with HSE (QSMS in Brazil) and site administration before you lock the process.


**Documentation and registration**

- [ ] The requesting company registers the contractor with name, ID and contracting company
- [ ] Trainings and documents required for the area have an expiry date in the register
- [ ] The vehicle, when there is one, joins the same request with plate and type
- [ ] Each company sees only its own contractors and requests

**Approval**

- [ ] The request states destination area, date, time and reason for access
- [ ] The responsible manager approves, denies or asks for a change, and the reason is stored
- [ ] A contractor with an expired document does not reach the gatehouse
- [ ] Every status change stores who acted, when and what changed

**Gatehouse and entry**

- [ ] The approved contractor receives a badge with a QR code and a validity period
- [ ] The gatehouse reads the QR and sees whether access is released, for which area and until when
- [ ] Entry is recorded with time, area and gatehouse operator
- [ ] The printed list or yesterday's email stops being the source of truth

**Exit and occupancy**

- [ ] Exit is recorded in the same system as entry
- [ ] Administration sees how many people from each company are on site now
- [ ] The contractor history shows entries, exits and approvals for the period
- [ ] In an emergency, you can list who is still on site

To use it with a vendor, ask for a demo with a real case from your operation: a contractor with expired training, a vehicle on the same request and an exit that must show up in occupancy. If the system handles those three cases in front of you, the rest tends to be tuning. For internal use, mark what already exists and start with approval and document validity, which are the items that most often create a queue at the gate.

## How do you roll out access control in stages?

Rollout works better in stages, starting with one gatehouse or one group of companies, with the spreadsheet still available for a short period.

1. Map the current process. List who requests, who approves, which fields the spreadsheet has and which rules live only in the head of whoever runs the gate.
2. Define the rules with administration and HSE (QSMS). Documents required by area, minimum lead time for a request, badge validity and the policy for returning visitors.
3. Register companies, people and vehicles. That register is the base of everything and must be right before you open it to users.
4. Start with one flow. Invite the companies that generate the most requests and watch the first weeks closely.
5. Move the check to the gatehouse. The team reads the QR on a phone or reader and records entry and exit in the same system.
6. Expand and switch off the spreadsheet. Company by company, until the spreadsheet is only a historical file.

The system needs to work well on a phone, because approval leaves the office and the check happens at the gate, often in a hurry and on an uneven connection. We build this kind of solution as [custom web systems](/en/services/custom-web-systems/). At shore support bases, the same register of people and companies often later serves other processes, as in the [port operations platform](/en/case-studies/port-operations/).

## What if the gatehouse already uses turnstiles or another system?

When the site already has turnstiles, readers or an older access system, the path is usually to integrate rather than throw everything away. The new system can handle scheduling, approval and the badge, and talk to whatever the equipment already exposes.

Before you decide, three questions help. Does the equipment or its server have a reliable API or query? Who maintains that system and how long does a change take? Is the problem in the register, in the approval flow or only in the gatehouse screen? In the industrial case we published, the system queries the equipment server to see which devices are online. Physical release is assessed device by device in the diagnostic.

If what is missing is linking access to a work permit or other safety processes, see our article on [digital permit to work](/en/blog/digital-permit-to-work/). A careful register of people and companies at the start avoids rework when those modules arrive.

## When is access control not enough?

An access-control system organises release and records what happened, but it does not decide on its own whether a contractor should enter a risk area without the manager's and HSE's review. That decision stays with people. The system makes the decision visible and recorded.

It also does not replace the safety briefing, the emergency procedure or evacuation training. What it does is keep the list of who is authorised and who is inside accurate when the gatehouse or administration needs it. Documents required by area are defined by the company and by HSE, not by the software.

If access control is the first step of something larger, such as permit to work, inspection or port operations, it is worth designing the register with those modules in mind. We build this kind of system as a custom software company, aligned to each site's process. If you want to look at your case, the diagnostic conversation has no cost.

## Frequently asked questions about third-party access control

### What is the difference between third-party access control and time and attendance?

Time and attendance records the working hours of the company's own staff. Third-party access control authorises and records entry for contractors, visitors and vehicles outside the permanent headcount, with validity, released area and prior approval. The two can coexist; one does not replace the other.

### Can the system block someone with an expired document?

Yes, as long as the register stores the required documents and training with an expiry date. At approval or at the gatehouse check, the system compares those dates with the access date and blocks anyone who does not meet the rule. The ideal is to warn the requesting company in advance, so it can renew the document or swap the person before the day.

### Do returning visitors need to be registered every time?

No. The person is registered once and can be included in new access requests. What changes on each request is the date, the area, the approver and the validity of that release. That cuts the queue at registration and keeps the history on the same record.

### How are contractors' personal data handled?

The system should collect what is needed to identify and authorise the person, with a clear purpose and restricted access. Each company sees only its own contractors. The change log records who approved or denied each access. That meets LGPD better than an open spreadsheet shared across several companies.

### Does the system need to work offline at the gatehouse?

It depends on how stable the network is at the gate. In many projects the check runs in a phone or tablet browser with a connection. If the network drops often, the design needs a contingency mode agreed with operations. That decision comes from the diagnostic, not from a single rule.

### How long does rollout take?

It depends on the number of companies, gatehouses, document rules and integrations with equipment that already exists. Starting with one group of companies and one gatehouse puts the system in use sooner and shows what to adjust before expanding. The timeline for a specific project only comes after mapping the current process.

## References

- [NR-01: General provisions and occupational risk management (updated 2024 text, Portuguese)](https://www.gov.br/trabalho-e-emprego/pt-br/acesso-a-informacao/participacao-social/conselhos-e-orgaos-colegiados/comissao-tripartite-partitaria-permanente/normas-regulamentadora/normas-regulamentadoras-vigentes/nr-01-atualizada-2024.pdf)
- [NR-23: Fire protection (updated 2022 text, Portuguese)](https://www.gov.br/trabalho-e-emprego/pt-br/acesso-a-informacao/participacao-social/conselhos-e-orgaos-colegiados/comissao-tripartite-partitaria-permanente/arquivos/normas-regulamentadoras/nr-23-atualizada-2022.pdf)
- [Law No. 13.709/2018: Brazil's General Personal Data Protection Law (LGPD)](https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm)