Give a vendor one app, for a set window, without a VPN.
A vendor or contractor needs one application, for the hours they work on it. With Pramaan you publish that application through a connector. The vendor reaches it only when their groups and your access rules allow it, and you end their access when the work is done.
One application, not your network
Publish the application through a connector: it dials out to the broker and opens no inbound port, and it relays only to targets on its own approved list.
Put the vendor in a group that only this application admits. When their browser asks for the application, the web edge checks the person's sign-in, their groups and your access rules, then relays the request over that app's connector. A private application is denied unless an access rule allows it, and being in the application's group is not enough on its own.
The connector is one of Pramaan's four ways in, and each stays off until its own switch is set.
A window, set in the rule
An access rule can be limited to the days of the week it applies on and a time-of-day window, both in UTC: a rule lists the days it applies on by weekday, from Sunday to Saturday, and a window that ends earlier in the day than it starts runs past midnight. Allow the vendor's group on the application inside the window. Outside it the rule does not match, and if no other rule allows the vendor, the default deny refuses the request.
The window is read from the broker's clock each time a request is decided, so at the web edge a request made after the window closes no longer matches the rule. The window repeats every week, and a rule has no end date: access that should end on a date ends when you deactivate the vendor.
Employees, contractors and AI agents
Employees
- Reach
- The apps their groups and your access rules allow
- Sign-in
- A passkey, a number-matched push or a code from an authenticator app
- Ending it
- Deactivate them: Pramaan revokes their sessions, their renewal tokens and every access token issued to them
Contractors
- Reach
- One application, through a group only it admits
- Window
- A rule sets the days of the week it applies on and a time-of-day window, both in UTC
- Ending it
- The window repeats every week, and a rule has no end date, so deactivate them when the work is done
AI agents
- Owner
- Each agent has exactly one human owner
- Ceiling
- The widest set of scopes an administrator lets it hold
- Tokens
- It gets access tokens only, with no ID token and no token to renew them, valid 300 seconds by default
- Kill switch
- Disabling it stops new tokens; tokens already issued stay valid until they expire
Ending access
Deactivate the vendor and Pramaan revokes their sessions, their renewal tokens and every access token issued to them. Their live direct connections are cancelled, not merely refused next time.
What the log keeps
When the web edge refuses a request, because of the person's groups or your access rules, the refusal is written as an audit event. Every audit event is added to the public transparency log, whose signed summary you can check without asking us.
For your engineers
Technical detail: direct connections and the log
On direct connections, the raw-TCP listener writes an audit event when its access checks refuse a connection after the person's token has been read. The transparency log follows RFC 6962; each audit event is a leaf.
Questions
Does the vendor need a VPN client?
Not for a web application. The connector dials out to the broker and opens no inbound port, and the vendor reaches the application through the web edge in a browser.
Can the window leave out the weekend?
Yes. A rule lists the days it applies on by weekday, from Sunday to Saturday, so leave Saturday and Sunday out. The times are in UTC.
Does access end on its own when the contract ends?
No. The window repeats every week, and a rule has no end date. Deactivate the vendor: Pramaan revokes their sessions, their renewal tokens and every access token issued to them, and their live direct connections are cancelled, not merely refused next time.
Is every request the vendor makes in the transparency log?
No. Refusals at the web edge are audit events. On direct connections, a connection the access checks refuse is written as an audit event once the person's token has been read; a refusal before that, or a connection that fails after it was allowed, is only logged. Every audit event reaches the log, but it is not a record of every access decision.
What if the vendor is still connected when the window closes?
At the web edge the next request no longer matches the rule. But a connection that stays open, such as a direct connection or a live browser connection through the web edge, is decided when it opens and is not cut when the window closes.
Talk to us, or try it first
-
Book a walkthrough
Against your own apps, not slides.
-
Run the lab
It uses a demonstration account; none of your data is involved.
-
See pricing
Published floors, named-user bands and what every tier includes.