Contractor QR Visitor Passes

A corporate campus hosted a constant stream of contractors — HVAC crews, auditors, delivery vendors — who needed temporary, scoped access to specific buildings. The front desk handed out paper passes and printed lanyard badges, with no enforcement of where they expired or whether they were ever returned. A contractor onboarded for a one-day job could still walk in a week later on the same badge.

The operator wanted visitor access issued as a verifiable, time-boxed credential bound to a checked identity, scoped to exactly the doors the job required.

The challenge

Contractor access had no real lifecycle. There was no identity verification at issuance, no enforced expiry, and no way to revoke a pass once it left the desk. Scope was honored by signage and trust rather than by the access system, so a vendor cleared for the loading dock could wander into office floors unchallenged. Reconstructing who was on site during an incident meant reading a paper visitor book.

They needed verified onboarding, scoped entitlements, automatic expiry, and instant revocation — delivered as something a reader or phone could check at the door.

What Veripass deployed

Veripass issued contractor access as time-boxed QR passes minted against a verified identity. At onboarding, the contractor’s identity was checked through ID-document and face verification, then a pass was generated carrying a QR credential scoped by an access profile to specific buildings and a fixed validity window. The QR was presented at gateways and readers, which validated it against the control plane before opening.

Entitlements were expressed through claims, capabilities, roles, and access profiles, so a dock vendor’s pass covered the loading area only while an inspector’s pass covered the floors under review. Passes expired automatically at the end of their window, and any pass could be revoked centrally. Every issuance, scan, and entry landed in an immutable audit trail.

• ID-document and face biometric verification at contractor onboarding
• Time-boxed QR passes bound to a verified identity
• RBAC from claims, capabilities, roles, and access profiles scoping the pass
• Context-aware policy: building set and validity window per pass
• Automatic expiry and instant central revocation
• Immutable audit trail of every issuance, scan, and entry

For restricted areas the pass carried a step-up condition: the contractor completed adaptive MFA over phone TOTP before the QR would open those specific doors, and the step-up was logged with the entry. Routine zones stayed friction-free with a plain scan.

Outcome

Stale contractor badges stopped accumulating, because passes expired on their own and were verified against identity at issuance. Scope was enforced by the access system rather than by trust, so a vendor cleared for the dock could not drift onto office floors. Revoking a contractor mid-job took effect on the next scan from one console.

During any review, the operator could produce a precise, immutable record of which verified contractor was on site, in which building, during which window, and whether they stepped up to reach a restricted area.