A vendor requests access through a form by defining their identity, reason for access, access scope, and time frame. The request is logged, and automatically sent to an administrator, who can approve or deny the request.
Does everybody have to fill out an access request form?