Check every contractor's certificate at source before granting any access to the review queue. Look it up by number or QR code on the issuer's own page, confirm the name matches the person you have identified, confirm the credential covers the depth they will approve, and record the check. Then re-check on a fixed cycle and before expiry.
Why do contractor certificates need extra care?
Outsourced review teams often handle the highest volume of an agent's held actions and sit furthest from the organisation's own training. The supplier sends a spreadsheet of names marked "certified", or a folder of certificate PDFs. Neither proves anything about today. A PDF can be altered, a name can belong to someone who left the supplier, and a certificate can have lapsed or been revoked since it was printed.
Treat a supplier's list the way an agent treats an emailed invoice: as external evidence that cannot, on its own, authorise anything. The guide to AI literacy and certification for people who work with agents explains why credentials for this work lapse, and whether contractors and outsourced staff should be trained to review AI agents makes the case for holding them to the same standard as staff.
Who owns the check?
The process owner who will rely on the contractor's approvals owns the requirement. Vendor management writes it into the contract. An administrator performs the check and grants access. The supplier's role is to provide certificate numbers and keep its people certified, not to vouch for them.
What are the steps?
- Person (vendor management): write the requirement into the contract. Which credential is needed for which depth of approval, that numbers are provided for checking, and that lapses and revocations must be reported promptly.
- Person (supplier): provides each reviewer's certificate number. Not a PDF, a number.
- Person (administrator): looks up each number at source. On the issuer's page or public register of certificates. Confirm name, credential, issue date, expiry and status.
- Person (administrator): matches the certificate to the person. The name on the certificate must match the identity verified during onboarding. A valid certificate held by someone else is not a valid certificate for this person.
- Person (administrator): grants access scoped to the credential. Approval rights only for the depths the credential supports.
- Agent, depth 1: logs every check. Date, number, result, administrator.
- Agent, depth 1: flags expiries and re-check dates. Contractors go on the same list as staff; see how to track certificates and renewals across a large team.
- Person (administrator): removes access on lapse, revocation or departure. The same day.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Contract requirement | Nothing | n/a | Writing and agreeing the clause |
| Collect numbers | Nothing | n/a | Supplier provides; administrator records |
| Check at source | Nothing | n/a | The lookup and its judgement |
| Identity match | Nothing | n/a | Confirming the holder is the person |
| Scoped access | Holds work for listed approvers only | 2 to 4 | Granting the right depth |
| Logging and flags | Records checks, flags expiries | 1 | Acting on each flag |
| Removal | Stops routing held work to them | n/a | Same-day removal |
What does a good check look like?
The number is looked up, not read. The administrator enters it on the issuer's page or scans the QR code, and reads the result there. A screenshot from the supplier is not a lookup.
The status is read in full. A lapsed or revoked certificate shows as such on the same page. Check expiry against the dates the contractor will work, not just today.
The credential matches the work. A foundations badge is a good sign of general literacy; it does not support approving payment releases at depth 4. Match the credential to the highest depth the contractor will approve.
The person matches the certificate. Names can be common. Match on the identity details confirmed at onboarding as well as the name. How to verify a training certificate is genuine covers the general method.
Which controls matter, and what evidence do they leave?
- A logged check per person. Evidence: date, certificate number, result, administrator name.
- Access scoped to credential. Evidence: the approver list for each depth, matched to the log.
- Periodic re-checks. Evidence: a dated result for each cycle.
- Same-day removal. Evidence: a dated change to the approver list.
- Supplier notifications. Evidence: the supplier's notices of departures and lapses, matched to removals.
What should be measured?
- Contractors with access whose certificate was checked at source: the target is all of them.
- Days from lapse or departure to removal.
- Approvals by contractors in the period made under a current credential.
- Supplier notifications received late or not at all.
Where does it go wrong?
Bulk onboarding. A supplier adds fifty reviewers before a peak and the checks are skipped "just this once". Plan for checking capacity before the peak.
Departures go unreported. Contractors move between clients. A reviewer who left the supplier may keep access for weeks. Monthly reconciliation against the supplier's current list catches this.
Expiry mid-contract. A certificate valid at onboarding lapses halfway through. Reminders work for contractors as for staff; a renewal reminder email template can be sent to the supplier's team lead. Academy certificates are issued through VerifyDoc.ai, so the same at-source check works for every holder, staff or contractor.
Questions people ask
Can the supplier perform the checks for us?
The supplier can check its own people, and should. But the organisation relying on the approvals should perform its own check at source. The point is independence from the party with an interest in the answer.
What if the issuer's page is unavailable?
Do not grant access until the check can be completed. A delay of a day is cheaper than an unqualified approver on the queue.
Do contractors need the same credential as staff?
For the same depth of approval, yes. The risk in an approval does not depend on who employs the approver.