Demo library › Chapter 4
4 Contractors get access; they do not get a laptop.
A contractor signs in from her own machine, with no client, and uses the wiki in a remote browser with copy, paste, download and print turned off.
The problem
Horizon Inc engages contractors - Ramona Flatley runs a sales territory on a six-month contract. She needs the wiki. Shipping her a managed laptop for six months is expensive and slow; letting her personal machine onto the network is worse. And whatever she can read, she can copy, download and keep.
Lands with: IT and security teams who onboard third parties, and procurement who pays for their laptops
Before you start
- A browser on a machine without the Cloudflare One client - or the lab client switched off - in a private window. Contractors get no device client; that is the point.
- Ramona's sign-in:
, passwordSavetheinternet!1.
Run it
One policy for her, beside the one for employees
| Do | Say |
|---|---|
| Zero Trust → Access controls → Applications → the wiki's application → policies. | Two: employees, and Contractors (isolated). Ramona is a contractor because the identity provider says so - the Contractors group is a claim, from HR's own employment type - and contractors are let in only inside a remote browser. |
As Ramona, open Nexus ( | She signs in with the company's identity provider and the wiki loads - fully usable, and running on Cloudflare's network rather than on her machine. Nothing to install, no network access, nothing left on her laptop when she closes the tab. |
| Select some text and try to copy it, then try to print or download a page. | None of it works. Traffic policies → Firewall policies → HTTP → Contractors: read-only wiki in isolation turns copy, paste, download, upload and print off for contractors, on this application. Employees on the same wiki are unaffected. |
| As Ramona, open WorkWeek. | Refused. The wiki is the application she was given; it is not a door to the rest. |
What the audience should see
- The wiki working in Ramona's browser with no client installed.
- Copy, download and print refused inside it.
- WorkWeek refused for her.
Where the evidence is
Access authentication logs: Ramona allowed to the wiki by Contractors (isolated), refused by WorkWeek. Gateway HTTP logs: her wiki requests with the Isolate action.
Known limitations
- Ramona exists in the company identity provider, as contractors often do. A contractor with no account at all would sign in with a one-time PIN to their own address - not provisioned here.
- Needs Browser Isolation on the account.
Part of: Secure web gateway and data protection · The full tour