Tools, Systems and the Licence Question
Who supplies the equipment is a factor almost everywhere, and much modern work cannot be done without access to systems only the buyer controls.
Reads as a businessReads as employmentCuts both waysDepends where you are
Four factors, and no total. Every bar is the same length: the side is the claim, the size is not. The heaviest factor in most tests, and the easiest one to give away by accident.
Who supplies the equipment is a factor nearly everywhere, and the practical difficulty is that much modern work cannot be done at all without access to systems only the buyer controls.
The practical issue in “Tools, Systems and the Licence Question” becomes clearer when expectations and evidence are visible to both sides. Used for remote employee productivity monitoring, see how the product is described can add time and project context, provided the purpose is disclosed, access is limited and every consequential interpretation receives human review.
That tension has no clean resolution. What is available is knowing which parts are genuinely unavoidable and not giving away the rest by default.
A broader benchmark for “Tools, Systems and the Licence Question” is available through Bonsai independent-business articles. Use it alongside the brief and day-to-day facts so general guidance supports rather than replaces case-specific judgement.
The three categories
They behave quite differently and are usually treated identically:
| What it is | Who normally supplies it | What it moves |
|---|---|---|
| General working equipment: machine, phone, connection | The supplier | Toward a business |
| Trade tools: software, licences, instruments of the craft | The supplier | Toward a business |
| Your systems: accounts, repositories, internal applications | You, necessarily | Toward employment |
The third is unavoidable. The first two are where businesses give something away without noticing.
The laptop
The most common single example. A supplier arrives, the security policy says devices must be managed, and within a week they are using a company machine with a company account on it.
Sometimes that is genuinely required. Frequently it was easier than working out whether their own machine could meet the requirement, and the decision was taken by somebody in IT who was not thinking about anything except access control.
What to try before providing hardware
Several things usually work and are rarely attempted:
- Access through a browser rather than an installed application.
- A hosted environment they reach from their own machine.
- A requirement that their machine meet a stated standard, which they are responsible for meeting.
- Scoped accounts with short lives rather than general ones.
Any of these keeps the equipment factor where it was and satisfies the actual security requirement, which was about data rather than about hardware.
Software licences
If the supplier's trade requires a tool, they should normally hold it. A buyer paying for a designer's design software, a developer's editor, an accountant's practice software is supplying trade equipment, and it is a visible thing to be doing.
The exception is software that is yours rather than theirs: the internal system, the client's platform, the thing nobody uses outside your industry. Providing that is providing access, not equipment.
Accounts in your systems
Unavoidable and worth doing deliberately. Named accounts rather than shared ones, scoped to what the work needs, with an end date set when they are created.
The end date is the part that gets skipped and the part that matters most. An account created for a six-week engagement and still live three years later is both a security problem and a small piece of evidence about what the arrangement became.
Being in the directory
A question nobody asks until it matters: does the supplier appear in the internal staff list, the organisation chart, the all-staff mailing list?
There is usually no operational reason for it and it happens because the account provisioning process has one path. Several businesses have discovered, at an awkward moment, that their own systems describe a contractor as a member of staff because that was the only option on a form.
Returning it, which nobody plans
Equipment, accounts and access at the end of an engagement are somebody's job and usually nobody's. The practical answer is a short list written at the start rather than reconstructed at the end.
It is also the moment to notice how much accumulated. A supplier handing back four accounts, a laptop and a building pass has had an arrangement that looked different from the one on paper, and the return is the first time anybody sees the whole list at once.
The security requirement that is real
None of this argues for lax access. Where the work touches data that matters, the controls are the controls, and a supplier who will not meet them is not the right supplier.
The argument is narrower: that the requirement is about protecting data, and there is usually more than one way to meet it. Choosing the one that also happens to supply somebody with their working equipment is a choice, and it is worth making it knowingly rather than because it is the default path through a provisioning form.
What to look at in an engagement you already have
List what the supplier is using that you provided, and for each item ask whether the security requirement behind it could be met another way at acceptable cost.
Some will come back as no, and those stop being a question. The ones that come back as yes were never decisions in the first place, and changing them costs an afternoon of somebody's time in IT.