Ask eight things about access: who can sign in, how they authenticate, what roles exist, what each role can see, whether actions are logged, how accounts are removed, how the vendor's own staff are limited, and how you test it. Public bodies often work under rules that expect reasonable access limits. This is not legal advice.
The rule behind the question
The FERPA regulation at 34 CFR 99.31(a)(1)(ii) says an educational agency or institution must use reasonable methods to ensure school officials obtain access only to the education records in which they have legitimate educational interests. If it does not use physical or technological access controls, its administrative policy must be effective. That rule is about education records, not security tools. But it shows the principle a public buyer works from: limit access to what the role needs.
For a security tool the equivalent is: findings, source code references and settings should be visible only to people who need them.
Eight questions
| # | Question | Good sign |
|---|---|---|
| 1 | Who can sign in, and how? | Single sign-on with your identity provider |
| 2 | Is multi-factor authentication supported and enforceable? | You can require it for all users |
| 3 | What roles exist? | At least admin, member and read only |
| 4 | Can roles be scoped to a project or team? | Yes, so a teacher or intern sees only their area |
| 5 | Are actions logged, and can you export logs? | Yes, with who, what and when |
| 6 | How are accounts removed when staff leave? | Automatic through your identity provider |
| 7 | Who at the vendor can access our tenant, and how is it logged? | Named process, logged, limited |
| 8 | Can we test a role before rollout? | A sandbox or pilot tenant |
What to test in the pilot
- Create a read only user. Try to change a setting. It should fail.
- Create a user scoped to one project. Look for another project. It should be hidden.
- Remove a user in your identity provider. Check that access ends, and note how fast.
- Export the audit log. Check it records the steps you just took.
- Ask the vendor to show what its support staff can see in your tenant, and how access is granted and logged.
Find the weak spots
- Shared accounts. Ban them. They destroy the audit trail.
- API tokens with no expiry or owner. Ask how tokens are created, scoped and rotated.
- Admin sprawl. Count admins at the end of the pilot. Fewer is better.
- Findings export. A report emailed to a personal address leaves your controls.
Small team reality
A two person IT team cannot run a complex permission model. Choose a tool with a simple role set you will actually maintain, and review the user list on a calendar date each term.
Record the answers
Put the eight answers in the purchase record next to the data flow notes. See data flow questions.
Safeguard supports policies, gates and guardrails and agent identity as part of its platform. Ask any vendor, including us, to show access controls in a live pilot rather than a slide.
Quick check
Does FERPA tell me how to configure a scanner?
No. It covers education records. Use its access principle as a guide for any tool.
What is the quickest access test in a pilot?
Create a read only user and try to change a setting. It should fail.
Sources
Last reviewed: 19 October 2026.
