Match the access model to who actually controls the person and the device. A freelancer is one account you can name. An agency adds a layer you must trust. Staff augmentation puts people inside your team. Each needs different identity, device and offboarding rules, so one contractor policy rarely fits all three.
The three arrangements
- Freelancer. One person, contracted directly. You know them, and nobody sits between you and them.
- Agency. A company delivers a project with its own team, which can change during the work. You contract with the company, not each person.
- Staff augmentation. Outside people join your team and work like staff, often for months, under your direction.
Comparison
| Question | Freelancer | Agency | Staff augmentation |
|---|---|---|---|
| Who do you know by name | One person | Account lead, maybe not the team | Each person |
| Team changes mid project | Rare | Common | Occasional |
| Devices | Their own | The agency's, varies | Yours or theirs, you decide |
| Typical GitHub setup | Outside collaborator | Outside collaborators per named person | Member or collaborator by length |
| Main risk | Single person, single laptop | Unknown people and shared accounts | Drift into permanent unreviewed access |
| Offboarding trigger | End date | End date plus each team change | End date or rotation |
| Contract clause that matters most | Code storage and deletion | Named personnel and notification of changes | Policy flow down and training |
Rules that apply to all three
- One GitHub account per human, with two-factor authentication. GitHub documents that when you require 2FA, outside collaborators without it are removed, so plan the rollout. See requiring 2FA for contractors.
- Lowest repository role, one repository at a time. See which role to give.
- Required pull request review and code owner approval on protected branches.
- A recorded sponsor and end date for every grant.
- A monthly check against your register, see the audit log routine.
Extra rules for agencies
Agencies are where access most often goes wrong, because the team behind the account lead changes.
- Ask for a named list of people who will have access, and require notice before it changes.
- Refuse shared logins. A shared account removes attribution and makes two-factor meaningless.
- Ask how the agency screens and trains staff, and how it handles a person leaving the agency. The post on vendor and contractor security training covers requests you can make.
- Ask where source code will be stored, and whether subcontractors will touch it. Subcontracting is a way for your code to reach people you never approved.
- Review the ISO 27001 evidence for outsourced development if you work toward that standard.
Extra rules for staff augmentation
The risk here is permanence. Someone who has been embedded for a year has accumulated roles, tokens and keys. Put them through the same review as staff, and cap the term of each role grant so it must be renewed. Consider a member account for the long run, but remember that converting a member to an outside collaborator at the end keeps their direct repository grants until you review them, as GitHub documents.
Extra rules for freelancers
The concern is the single device. Specify where code may live, require full disk encryption and screen locks in the agreement, and prefer a fork workflow for sensitive code. See forks or branches.
Choosing
If you have regulated code and little visibility into people, prefer fewer, named individuals with narrow access, whatever the model. If you must use an agency, make the named personnel clause non negotiable.
Try it yourself
Click through it at your own pace, or open it full screen.
See how one control can map to several frameworks, which is how a single contractor access rule can serve more than one audit.
Safeguard's compliance and evidence automation supports that kind of mapping, and its asset discovery helps keep your list of repositories and accounts honest. Start with the free scan.
Quick check
Is an agency riskier than a freelancer?
Not inherently, but you see fewer of the people. Named personnel, no shared logins and change notification are the compensating controls.
Should long term staff augmentation use member accounts?
Often, yes, if they work like staff. Review their access like staff and convert or remove them at the end.
Sources
- Requiring two-factor authentication in your organization
- Converting an organization member to an outside collaborator
Last reviewed: 19 October 2026.
