Users, Legal Entities and Affiliate Access

Name organizations before counting seats

Begin with the legal entity expected to sign and the entities whose staff will actually use the service. Record registered names rather than brand labels alone. A group treasury team, an investment subsidiary and a joint venture may share systems while carrying different contractual relationships. Ask the agreement reviewer how the proposed parties fit the definitions, rather than assuming that a common parent or shared office makes every participant eligible.

Nasdaq's published affiliates policy provides a concrete example of a definition and listing process tied to its own data agreement. It is not a universal ownership test for investment-model licences. Use it as a prompt to request the actual affiliate definition, admission process and maintenance responsibility for the proposed transaction. Do not transplant another provider's threshold or procedure into a contract that uses different language or governs a different product.

Distinguish people from technical identities

Inventory named analysts, reviewers, administrators and automated service identities separately. A technical account can deliver results to many people, so one credential does not necessarily describe one recipient. Conversely, a single person might have separate accounts in testing and production. Ask which measurement the proposed licence uses and how the buyer can evidence compliance without storing unnecessary personal information or sharing credentials between individuals for administrative convenience.

Describe what each identity can do: view scores, download history, edit configuration, administer access or forward material. Permissions should follow the approved purpose and organizational boundary, not simply the most convenient default role in an application. Keep identity-management design distinct from the commercial counting rules. A technically secure arrangement can still be outside agreed scope, and a correctly counted seat does not prove its access is appropriately restricted.

Handle reviewers and contractors explicitly

Independent specialists may need documentation, sample outputs or code to evaluate a proposed purchase. Identify the specialist's organization, purpose and expected access duration before sharing. Ask whether that review is covered or needs additional arrangements. An external auditor, implementation contractor and reseller perform different activities; calling all three advisers obscures the question. Avoid suggesting that a confidentiality agreement alone necessarily authorizes disclosure of every supplied component or underlying dataset.

WIPO's trade-secret FAQ describes confidentiality measures as relevant to protecting secret information. The operational implication is to plan reviewer access deliberately, not to make a legal finding that a particular file qualifies as a trade secret. Use controlled copies, clear recipients and a documented review purpose where appropriate. Have qualified counsel assess the actual disclosure and obligations, including local law and any conflicting terms in the buyer's existing adviser engagement.

Work through a hypothetical access map

A hypothetical buyer proposes access for six analysts employed by the signing entity, four analysts employed by a subsidiary and two external validation reviewers. That is twelve people, across three organizational categories. Two automated identities would retrieve outputs and manage access. The inventory therefore contains fourteen identities, but it does not establish fourteen chargeable seats. Commercial treatment remains a question for the proposed agreement, not an arithmetic consequence of the inventory.

The procurement owner asks separately about the subsidiary, the external reviewers and both service identities. The six employees do not become a substitute for listing the other recipients. If only the signing entity's evaluation scope is resolved, the other paths remain disabled while review continues. This is an invented workflow to demonstrate scoping, not a statement that any real provider has accepted the arrangement or uses this counting method.

The access owner then tests the map with synthetic records: an approved analyst can view the evaluation sample, a reviewer cannot export the full history, and a disabled identity cannot retrieve new outputs. These checks test technical implementation of the proposed boundaries. They do not themselves settle whether the contract covers those boundaries.

Plan for organizational and staffing changes

Joiners, leavers, secondments and acquisitions can change the map after signature. Define who reports these changes and who decides whether access should wait for clarification. A user transferring to another entity may keep the same email address while changing the relevant scope. An acquired business may have its own supplier arrangements. Treat these events as review triggers rather than assuming either automatic inclusion or automatic termination without examining the actual documents.

Reconcile application accounts with the approved entity list periodically and after significant organizational events. Include dormant accounts, shared integration credentials and recipients of scheduled exports. Record exceptions with a purpose and an expiry date when appropriate. Avoid claiming that an access review proves legal compliance in every jurisdiction; it establishes a narrower operational fact about who can reach the system and how that compares with the documented permission decision.

Leave a maintainable scope record

The final record should identify the contracting entity, approved participating entities, user categories, access purposes and change process. Link each approval to the relevant document version or reviewed clarification. Keep commercial counts reproducible from the same definitions used during procurement. This reduces disagreement at renewal and gives a new administrator enough context to operate the service without reconstructing the original negotiations from disconnected emails and meeting recollections.

Where a definition remains ambiguous, describe the exact recipient and activity awaiting review. Do not convert an ownership percentage, job title or shared network into a general legal rule. The appropriate answer depends on the actual agreement and applicable jurisdiction. A useful procurement outcome is an access map whose boundaries can be explained, implemented and reviewed, with unresolved recipients visible before they receive model material or confidential information.

• Maintain entity scope separately from login counts.
• Review contractors and service accounts as explicit categories.

Source notes

1. Nasdaq: Addition of Affiliates Policy
2. WIPO: Frequently Asked Questions on Trade Secrets