Approve a service, not a hole in the network.
If a vendor asks to reach software you host, this is the control you keep. You are the Environment-scoped Approver. The vendor does not receive your network.
- Authority
- You decide the Environment approval policy. You may require your approval for every request, or expressly let the vendor approve bounded requests with a complete audit trail you can revoke. You decide yes, no, or stop on a request when you have not delegated. Revoking a live grant ends the connection that is already open.
- Scope
- The grant is for one named Service, not a subnet, a desktop, or every port on a host.
- Time
- Grants have explicit validity bounds. Those bounds are enforced on live sessions, not only on new ones.
- Outbound connection
- The Agent dials out. You do not open a vendor-facing inbound port.
- Data handling
- Thirp retains access metadata—who, which Service, when, how long. It does not retain relayed payloads or session recordings.
Your vendor should introduce you. If you are evaluating Thirp together, ask the vendor to include your Approver and security owner from the start.