Is an electronic signature valid?

Yes. Electronic signatures are legally enforceable under the ESIGN Act and UETA when intent, consent, attribution, and record retention are satisfied (15 U.S.C. ch. 96; UETA).

Do I need a notary or witnesses?

Not generally required for access addenda, but state rules or the underlying contract may require a notary or witnesses for property transfers or certain powers of attorney.

How do I revoke access?

Follow the revocation procedure in the addendum: provide written notice as specified, revoke credentials immediately, and document the revocation in audit logs for evidentiary purposes.

What authentication level is appropriate?

Use stronger authentication (MFA, ID credential analysis) for privileged or PHI access; weaker methods may suffice for low-risk viewing rights, subject to contractual agreement.

Can I amend the addendum later?

Yes. Amendments should be executed with the same formalities as the original addendum and retain clear effective dates and signatures to avoid ambiguity.

Where should I store signed copies?

Store executed addenda and audit logs in a secure, access-controlled repository with exportable records; retain according to regulatory timelines such as IRS and HIPAA requirements.

Electronic Signature
Templates
Miscellaneous
Access Permission Addendum

Access Permission Addendum

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

ACCESS PERMISSION ADDENDUM

THIS ACCESS PERMISSION ADDENDUM ("Addendum") is made effective as of by and between:

Grantor Name: Recipient Name:

RECITALS

WHEREAS, Grantor and Recipient are parties to an existing agreement identified as: Master Agreement Date: (the "Agreement");

WHEREAS, the parties desire to document and supplement the Agreement to permit Recipient limited access to specified premises, systems, or information under the terms set forth in this Addendum; and

WHEREAS, the parties intend that access be granted only for the purposes and during the period expressly set forth herein and subject to security, insurance, and compliance requirements provided below.

SCOPE OF WORK / ACCESS DESCRIPTION

Describe access to be granted

ACCESS DETAILS

Access Type: Physical access to premises Electronic/system access Mobile/remote access

Specific location(s) or system identifiers

Access Period Start: Access Period End:

Access hours / frequency Security measures and required credentials Badges, keys, or access tokens to be issued (describe quantity and return procedure)

PAYMENT TERMS

Total Access Fee (if applicable) Payment schedule / Milestones Late payment fee Invoice address for billing

TERM AND TERMINATION

This Addendum commences on and continues until unless earlier terminated as provided herein.

Either party may terminate this Addendum for convenience upon written notice delivered at least days prior to the intended termination date.

Notwithstanding the foregoing, either party may terminate immediately for material breach by the other party that is not cured within 10 days after written notice or immediately upon discovery of a security incident affecting protected systems or data.

CONFIDENTIALITY

Recipient acknowledges that certain information, records, systems, and materials made available in connection with access under this Addendum may be confidential. "Confidential Information" includes non-public business, technical, security and personal data disclosed or observed in connection with access, whether marked confidential or not.

Recipient shall: (a) use Confidential Information solely for the purposes authorized in this Addendum; (b) implement administrative, technical and physical safeguards consistent with industry standards to protect Confidential Information; and (c) not disclose Confidential Information to any third party except as permitted by the Agreement or required by law, provided Recipient gives prompt notice and cooperates in any effort to limit disclosure.

The obligations in this Section survive termination of this Addendum for a period of years, unless a longer period is required by applicable law.

INSURANCE, INDEMNITY AND LIABILITY

Recipient shall maintain insurance policies and limits reasonably appropriate for the scope of access granted, including commercial general liability and cyber/security insurance where relevant. Recipient indemnifies and holds harmless Grantor from third-party claims arising from Recipient's unauthorized use of access or breach of this Addendum, except to the extent caused by Grantor's gross negligence or willful misconduct.

EXCEPT FOR LIABILITY ARISING FROM BREACH OF CONFIDENTIALITY, GROSS NEGLIGENCE, OR WILLFUL MISCONDUCT, NEITHER PARTY WILL BE LIABLE FOR CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES IN CONNECTION WITH THIS ADDENDUM.

COMPLIANCE WITH LAWS AND POLICIES

Recipient shall comply with all applicable laws, regulations, and Grantor policies relevant to access, safety, data protection, and background checks. Grantor may withhold or revoke access if Recipient or its personnel fail to satisfy required background checks or security clearances.

GOVERNING LAW

This Addendum shall be governed by and construed in accordance with the laws of the State of , without regard to its conflict of law principles.

ENTIRE AGREEMENT

This Addendum, together with the Agreement, constitutes the entire agreement between the parties with respect to the subject matter herein and supersedes all prior or contemporaneous agreements, understandings, and representations. Any amendment to this Addendum must be in writing and signed by authorized representatives of both parties.

NOTICES

Notice address for Grantor Notice address for Recipient

Certification: Each party represents and warrants that the person signing below is authorized to bind the respective party to this Addendum.

Grantor Printed Name:

By:

Date:

Recipient Printed Name:

By:

Date:

What the Access Permission Addendum Is

An Access Permission Addendum is a contract attachment that defines who may access specified property, systems, or records, the permitted scope of access, and the duration and conditions for that access. It supplements a primary agreement by documenting roles, technical and physical access limits, authentication requirements, and any monitoring or reporting obligations. In the United States this addendum is routinely executed electronically under ESIGN (15 U.S.C. ch. 96) or intrastate UETA rules where adopted, provided the parties meet intent, consent, attribution, and retention requirements.

Why adding a formal access clause matters

A clear Access Permission Addendum reduces disputes by specifying who may enter or view assets, how access is authenticated, and how access is revoked. It supports auditability, regulatory compliance, and operational continuity while allocating responsibilities for security controls and data handling.

Typical parties who complete this addendum

Organizations add an Access Permission Addendum when granting third-party access to premises, systems, or records; it clarifies obligations and reduces downstream liability.

Real Estate managers and landlords granting contractor or vendor access for repairs, inspections, or showings.
Healthcare providers or business associates who permit external vendors to access PHI under HIPAA-compliant controls.
Legal departments and counsel authorizing outside counsel or experts to access client files or corporate records.

Use the addendum when access is non-routine, involves sensitive data, requires conditional permissions, or when an auditable trail of consent and revocation is needed.

Core elements to include in a professional addendum

A well-drafted Access Permission Addendum balances clarity and enforceability: define parties, scope, duration, authentication, monitoring, and remedies for misuse. Tailor each section to the industry and applicable laws.

Parties

Identify the grantor and grantee using legal entity names, including DBA where applicable, and include contact and notice addresses for each party.

Scope

Describe precisely what resources or locations are covered (systems, databases, rooms), permitted activities, and any exclusions or limitations on access.

Duration

Specify effective and expiration dates, intermittent access windows, renewal conditions, and procedures for early termination or suspension of access.

Authentication

Set required authentication methods (email+SMS, MFA, ID credential analysis), acceptable credentials, and procedures for credential revocation or replacement.

Monitoring

State logging and monitoring expectations, retention of audit records, notification obligations for incidents, and who reviews access logs.

Liability

Allocate responsibility for unauthorized access, indemnities, insurance expectations, and remedies including injunctive relief and termination rights.

Step-by-step: completing and executing the addendum

Follow this sequence to prepare, review, sign, and distribute the Access Permission Addendum reliably.

01

Draft: Populate parties, scope, duration, and authentication details; attach supporting exhibits.
02

Review: Legal and security teams confirm obligations, insurance, and any HIPAA or industry-specific language.
03

Sign: Execute via electronic signature compliant with ESIGN/UETA; include signer authentication as required.
04

Distribute: Provide completed copies to all parties and retain an auditable copy in records management.

How to configure an online workflow for this addendum

Set up a simple, auditable workflow that matches the sequence above and enforces required fields and authentication.

Field	Configuration
Signer Authentication	Use email link plus SMS code or MFA for sensitive access grants
Required Fields	Make parties, effective date, scope, and signature mandatory
Order of Signing	Use role-based routing when multiple approvals are required
Audit Trail Capture	Record IP, timestamp, and signer attribution automatically

Technical considerations for electronic execution

Ensure the chosen platform supports required authentication, audit trails, and secure storage to meet contractual and regulatory needs.

Authentication Support: MFA, SMS codes, or knowledge-based checks
Audit Trail: Tamper-evident logging of signatures and actions
File Formats: PDF or DOCX output with embedded metadata

Security and compliance items to verify

Encryption: TLS in transit; AES-256 at rest

Audit Trail: Comprehensive signer actions logged

HIPAA BAA: Execute BAA if PHI is involved

Access Controls: Role-based access and periodic review

Multi-Factor: MFA recommended for privileged access

Retention: Durable storage and exportable logs

Common preparation mistakes to avoid

Leaving scope language vague so disputes arise over what was authorized or when access ends.
Failing to require specific authentication, allowing easy impersonation or unauthorized access.
Omitting audit and logging requirements, which undermines incident response and forensic review.
Not aligning revocation procedures with operational reality, causing delays when access must be cut quickly.

Consequences of a flawed or missing addendum

Unauthorized Access: Potential civil liability and remedial obligations

Regulatory Exposure: HIPAA or sector fines and corrective action

Contract Disputes: Breach claims and indemnity obligations

Operational Loss: Business interruption or data loss

Reputational Harm: Customer trust erosion and brand damage

Evidence Gaps: Weak audit trail impedes legal defense

Timing, notices, and processing expectations

Track effective dates, renewal windows, and notice periods carefully; delayed revocation or missed renewal can create legal and security exposures.

Request Date:

Date on which access is requested by the grantee

Effective Date:

MM/DD/YYYY governs when access and obligations start

Review Period:

Periodic access reviews every 90 days recommended

Renewal Notice:

Require written renewal request 30 days before expiry

Revocation Deadline:

Specify timeline for revocation to take effect

eSignature vendor comparison for executing addenda

Compare basic price and key features when choosing an eSignature provider; signNow appears first for clarity and consistent comparison.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day trial	Varies	Varies	Varies	Varies
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently asked questions about the Access Permission Addendum

Answers to common execution, enforcement, and compliance questions about using and signing an Access Permission Addendum.

Need help? Contact support

Is an electronic signature valid?
Yes. Electronic signatures are legally enforceable under the ESIGN Act and UETA when intent, consent, attribution, and record retention are satisfied (15 U.S.C. ch. 96; UETA).
Do I need a notary or witnesses?
Not generally required for access addenda, but state rules or the underlying contract may require a notary or witnesses for property transfers or certain powers of attorney.
How do I revoke access?
Follow the revocation procedure in the addendum: provide written notice as specified, revoke credentials immediately, and document the revocation in audit logs for evidentiary purposes.
What authentication level is appropriate?
Use stronger authentication (MFA, ID credential analysis) for privileged or PHI access; weaker methods may suffice for low-risk viewing rights, subject to contractual agreement.
Can I amend the addendum later?
Yes. Amendments should be executed with the same formalities as the original addendum and retain clear effective dates and signatures to avoid ambiguity.
Where should I store signed copies?
Store executed addenda and audit logs in a secure, access-controlled repository with exportable records; retain according to regulatory timelines such as IRS and HIPAA requirements.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now