How should organisations govern vendor access in enterprise access management?

Organisations should treat vendor access as time-bound, task-bound, and fully revocable. The key is to issue the minimum entitlement required, record an owner for the access, and remove it when the vendor task ends. Broad or shared access creates unnecessary blast radius and makes offboarding unreliable.