EntityLocker Business Onboarding and Representative Authority
Design EntityLocker business onboarding around two decisions. Verify the organisation's evidence and establish who can act for it in your application.
Verify the organisation and its representative separately when you onboard a business. An entity record can identify the company. Your application must also establish who may submit documents or accept an obligation for that company.
The EntityLocker requester specification includes separate entity and user details. The DPIIT advisory describes organisational records and controlled sharing. Use these as inputs to your application design. EntityLocker requester specification DPIIT advisory of 24 August 2026
Decide what each source establishes
| Question | Evidence to review | Decision owner |
|---|---|---|
| Which organisation is this? | Applicable entity record and legal name | Business onboarding team |
| Who is the person signing in? | Authenticated application account and required identity evidence | Identity owner |
| May this person act for this entity? | Current delegation, appointment, or internal approval | Organisation or platform approver |
| May this person share this document? | Permission for the record and purpose | Document owner |
| Can this person accept an agreement? | Authority for the particular action | Contract owner |
A verified organisation identifier gives your application a matching key. Define the role and approval evidence needed for the next action.
Separate application roles
A business user can have permission to upload evidence without permission to sign a contract. A finance reviewer can check a tax document while another person manages administrators. Model these as distinct actions.
Consider a synthetic case in which a company replaces its procurement manager. The entity remains the same. The former manager loses authority and the successor receives a role after approval.
Keep historical sharing decisions linked to the person who made them. Recheck the current role before each new action.
Handle a change during an open request
- Find the pending request and its assigned representative.
- Check whether that representative still has the required authority.
- Close or reassign the request under the approved process.
- Record the reason and the authorised operator.
- Ask the new representative to complete the required action.
Define how the application handles a stale approval or revoked organisation role. Include the scenario in your onboarding tests.
Keep the evidence specific
Record which document and purpose an approval covers. A record shared for vendor registration should not automatically become available for a later unrelated review. Give reviewers enough context to see what they may use.
For startups preparing company records, start with a document inventory and named owners. EntityLocker startup guide.
Review representative access with NamoID
NamoID engineers can help design the application accounts, organisation roles, and access decisions around your entity workflow. Share a synthetic example of a representative change or document-sharing request. Message the NamoID team in Slack