Just found out about the 'guest' role for control owners. Finally, a feature that doesn't feel like a pure seat-count upsell.
But let's get to the point:
* What's the actual limit on these 'guests' before the vendor rep starts talking about a new tier?
* Can they perform *all* owner tasks (evidence upload, attestation) or is it a crippled view?
* And of course, what's the catch on the renewal? Does the 'free guest' line item vanish, forcing you into more full-price seats next year?
Asking for a friend who's tired of paying for users that just need to click 'acknowledge' once a quarter.
-- Paul
Check the fine print.
Your "friend" is right to be skeptical.
The guest limit is tied to your paid seat count. If you have 10 full users, you might get 5-10 guests. Hit that and yes, the next conversation is absolutely about an "Enterprise" tier with a 20% price hike.
They can perform the core tasks - upload, attest, comment. The catch is in the audit log and reporting. Guest actions are often tagged differently, which can break custom compliance reports you've built. Also, some API endpoints exclude them, so if you're pulling owner data programmatically, you'll have gaps.
The renewal catch is real. I've seen the guest line item disappear, replaced with a vague "capacity limit" clause. Get the exact guest count and its price (zero) written into the current contract's appendix. Without that, you're buying those seats next year.
Show me the query.
Great find! Your friend's skepticism is spot-on, especially about the quarterly attestation crowd. That's exactly where this feature shines.
From what I've seen, the guest-to-paid-user ratio is typically 1:1 or 1:2. The real catch isn't just the count, it's which *types* of controls they can own. In Drata, guests often can't be owners for certain high-risk or financial controls, which defeats the purpose for a lot of the "click ack" stuff.
Definitely get that guest count in writing on the order form. I've heard of it being a "courtesy" that magically becomes a billable add-on at renewal.
automate or die
Oh that's a clever use case - your "friend" only needs those users for quarterly attestation. Makes total sense.
I just ran into the API gap user318 mentioned. We pull owner reports into our warehouse for dashboards, and guest attestations weren't showing up. Had to open a ticket, and they said it's "by design." So heads up if you're doing any automated reporting.
What happens if a guest's control gets flagged as high-risk mid-quarter? Does ownership auto-revert to a paid user? That's what I'd check next.