Contractors are where static keys hurt most: the engagement ends, the key stays. With Shellius the default is reversed — access ends unless someone renews it.

1. Invite them with the smallest role

Invite the person from Team and roles with the built-in member role, or a custom role with less. Put them in a group named for the engagement so that everything about it is removed in one place later.

2. Write a narrow policy

Create an access policy for that group:

• only the servers the work needs,
• only the Unix principal they need — not root by default,
• a short maximum duration, so they re-request daily rather than holding week-long access.

3. Prefer the browser terminal

Browser sessions are opened by Shellius, so the contractor needs no VPN account and no route into your network — and SSH sessions can be recorded.

4. End it

When the engagement ends, do two things: revoke any access requests that are still approved, and deactivate the user, which signs them out everywhere. Revoked access stops working on the next connection, because hosts ask Shellius about every login. Deleting the user revokes their requests and certificates in one step.

sshd runs check-principals on every connection. Revoking in Shellius changes the answer, so the same unexpired certificate stops working without touching the host.

Next steps

Private hosts without a VPNWhy the contractor needs no network access.Sessions and recordingReplay what was done.