How to build a secure contractor onboarding workflow with role-gated IT access handoff in Formaloo

By the end of this guide, you'll have a two-page contractor onboarding form that collects identity details, the right tax form for the contractor's country, and an e-signed NDA. Every submission generates an internal PDF record, routes automatically from HR to IT through Status changes, and lands in a portal where contractors, HR, and IT each see only their own slice of the process.

Start with a Form project from your Formaloo homepage, since it comes with one form pre-attached and a table already connected to it. This is where contractors will submit their identity details, tax paperwork, and signed NDA.

1. Open Magic Create: From your Formaloo homepage, click Magic Create, then describe your form in plain text instead of building it field by field.

2. Paste this prompt: "Build a two-page contractor onboarding form. Page 1: full legal name (short text), email address (email field), contractor start date (date), engagement type (dropdown: Independent contractor, Corp-to-corp, International contractor), country filed for tax purposes (dropdown: United States, Outside the United States), a file upload for the W-9 form, and a file upload for the W-8BEN form. Page 2: a yes/no question asking if they've read and agree to the NDA, and a signature field for signing the NDA. Also add these admin-only fields: a Status dropdown (Submitted, Documents verified, Pending IT provisioning, Access granted, Onboarding complete), an Assignee field, an internal notes long text field, a multi-select dropdown for systems and access required (Email & chat, Source code repository, Cloud infrastructure, VPN, Customer data systems, Physical badge/office access), and a yes/no field for IT provisioning complete."

3. Click Create: Formaloo builds the full two-page form from that description in seconds.

4. Verify your fields match this table: Magic Create will have generated most of this for you. Check each field and field ID matches exactly before moving on.

5. Add the signature field manually if Magic Create didn't include it: Click the + button on page 2, scroll to Signature, and select it. Formaloo's signature field lets contractors sign by drawing or typing their name, and it's built for exactly this kind of legally binding e-signature.

6. Publish the form: Click Publish in the island bar at the top of the editor. This is different from Save, which only applies to logic rules, email templates, and PDF templates.

This is where the form gets smart about which tax document to ask for and stops a contractor from signing before they've actually agreed. All of this lives in the same form's advanced logic, no separate automation tool needed.

1. Open Advanced logic: In the form editor, open Form settings on the right side and click Advanced logic, then go to the Logic tab.

2. Click Magic Logic: In the top-right corner of the Logic panel, click Magic Logic to open the prompt window.

3. Paste this Magic Logic prompt: "If 'What country do you file taxes in?' equals 'United States,' show and require 'Upload your W-9 form.' If it equals 'Outside the United States,' show and require 'Upload your W-8BEN form.' Both uploads are hidden and not required by default. If 'Have you read and do you agree to the terms of the NDA?' equals 'Yes,' show and require 'Sign the NDA below.' It's hidden and not required by default."

4. Click Generate rules: Review the AI's preview of each rule, approve, redo, or cancel as needed, then make any manual adjustments.

5. Click Save in the top-right corner once you're happy with the rules.

Note: Because the signature field only shows up after the contractor answers "Yes" to the NDA question, there's no way to reach the submit button without agreeing first.

Four short, targeted emails run this workflow: one confirms the submission to the contractor, one alerts HR, one hands the request to IT, and one tells the contractor they're cleared to start. Building all four now means the logic in Part 5 has something to actually send.

1. Open the email template builder: Click your profile icon, go to Apps and integrations, and open Custom email templates. Click Add new template.

2. Build the "Submission received" template: Set the subject to "Thanks for completing your onboarding paperwork, @full_legal_name." Clear the body, add an AI block, and use this prompt: "Write a warm, reassuring confirmation email to a new contractor who just submitted their onboarding paperwork. Confirm it was received, that HR will review it and follow up before their start date, and that they don't need to do anything else right now. 3 to 4 sentences, under 80 words." Name and save the template.

3. Build the "New submission for review" template: Set the subject to "New contractor onboarding submitted: @full_legal_name (ref CO-@rowid)." Use this prompt: "Write a short, factual internal email to the HR onboarding team announcing a new contractor submission. State the contractor's name, engagement type, and start date, and note their documents are ready for review. Under 60 words, no small talk." Save the template.

4. Build the "New IT access request" template: Set the subject to "IT access request: @full_legal_name starts @start_date (ref CO-@rowid)." Use this prompt: "Write a short, factual internal email to the IT team asking them to provision access for a new contractor. Reference the systems requested and ask them to mark the request complete once access is granted. Direct tone, under 70 words." Save the template.

5. Build the "You're all set" template: Set the subject to "You're all set to start, @full_legal_name." Use this prompt: "Write a warm, brief welcome email confirming a contractor's system access has been provisioned and they're ready to begin on their start date. Mention who to contact if anything doesn't work on day one. Under 70 words." Save the template.

Every submission needs one internal record combining identity, tax filing status, and the signed NDA, something HR and IT can point to later if anyone asks whether onboarding actually happened correctly.

1. Open the PDF template builder: Click your profile icon, go to Apps and integrations, and open Custom PDF templates. Click Add new template.

2. Switch to HTML view: Toggle the editor to HTML and paste your PDF's markup, or design it directly in the visual editor if you'd rather not hand-code it.

3. Reference your fields with @ variables: Use @full_legal_name, @email_address, @tax_country, @w9_upload, @w8ben_upload, @nda_signature, @status, @rowid, and @created_at wherever those values should appear.

4. Name the template and click Save.

Note: This PDF is an internal audit record, not something to email the contractor. Keep it off any outgoing email and let HR and IT pull it from the response row when they need it.

This is the part that actually moves a submission from "just arrived" to "IT is on it" to "done," without anyone manually forwarding anything.

1. Add the On Submit rule: In Advanced logic, open the On Submit tab and click Add rule. Set the actions: assign 'Status' to 'Submitted,' assign 'Assignee' to your HR onboarding team, send the 'Submission received' template to @email_address, send the 'New submission for review' template to your HR team's shared inbox, and generate a PDF using your onboarding PDF template.

2. Add the On Update rule for the IT handoff: Open the On Update tab and click Add rule. Condition: 'Status' is changed to 'Pending IT provisioning.' Actions: assign 'Assignee' to your IT team, and send the 'New IT access request' template to the IT team's shared inbox.

3. Add the On Update rule for completion: Add a second On Update rule. Condition: 'IT provisioning complete' is changed to 'Yes.' Actions: assign 'Status' to 'Access granted,' and send the 'You're all set' template to @email_address.

4. Click Save in the top-right corner.

Note: HR moves a record to "Pending IT provisioning" manually once documents check out, which is what actually triggers the handoff to IT.

The last piece is giving contractors, HR, and IT each their own view: contractors track their own status, HR sees everything, and IT sees only the requests waiting on them, nothing else in your workspace.

1. Activate the portal: Open your project, click the gear icon, and select Activate portal. Click Manage users, then run the Setup wizard: connect a new user directory for contractors, configure login and sign-up settings, then enable the user profile on your onboarding form so contractors only see their own submissions.

2. Build the contractor's submit page: Add your onboarding form as a Form block on its own page, titled "Submit your onboarding paperwork."

3. Build the contractor's status page: Add a Table data block titled "My onboarding status," connected to the same form. Switch to Edit mode, open Options, scroll to Manage access, select the profile field, and toggle on Allow users to view only their data. Leave editing off, since this page is read-only.

4. Build the HR group's pages: Add a Kanban block titled "All contractors," grouped by Status. Add three Table blocks: "New submissions" (sorted newest first, unfiltered), "Pending IT provisioning" (filtered to Status is Pending IT provisioning, oldest first), and "Onboarding complete" (filtered to Status is Access granted).

5. Restrict the HR pages to your HR team: On each HR page, open the three-dot menu and click Access. Under internal users, select your HR onboarding team so no one outside HR sees these pages by default.

6. Build and restrict the IT team's pages: Add a Table block titled "IT access queue," filtered to Status is Pending IT provisioning, sorted oldest first. Add a Kanban block titled "My assigned handoffs," grouped by Status. On both pages, open Access and restrict them to your IT team, the same way you did for HR.

7. Scope "My assigned handoffs" to each IT member's own queue: Switch that block to Edit mode, open Options, scroll to Manage access, select the Assignee field, and toggle on Allow assignees to view only their data. Now each IT team member sees only the requests assigned to them.

A single form now handles a contractor's entire onboarding paperwork, the right tax document for their country, and a legally binding NDA signature, all encrypted by default and backed by an internal PDF record. Status changes alone move the record from HR's queue to IT's, and Assignee-based access means IT only ever sees the requests waiting on them, never the rest of your workspace's data. Contractors get a real answer to "am I set to start yet" without emailing anyone, and every handoff between teams is timestamped and traceable.

Don't build this from scratch, we've already put it together for you.