A single facility hosts three types of external party, each with a different legal relationship to the organization — and therefore a different violation route. A contractor is bound by a contract with clauses and penalties. A tenant or operating company is bound by an agreement or site regulation. A visitor is bound by nothing beyond site rules.
The most common mistake is handling all three through one route. The result is meaningless mandatory fields, objection routes that do not suit the party, and data unusable for analysis. Contractor and visitor violations, along with company violations, need clear separation from the moment of logging.
The Substantive Differences
| Dimension | Contractor | Company | Visitor |
| Basis | Contract clause | Agreement or regulation | Site rules |
| Consequence | Deduction or penalty | Notice and undertaking | Immediate action |
| Identity | Known and registered | Known | May be unknown |
| Deadline | Contractually stipulated | Agreed | Immediate |
| Recurrence | Affects renewal | Affects the relationship | Affects access decisions |
| Objection | Formal documented route | Administrative route | Rarely applicable |
The third row is what design most often overlooks: a visitor violation may be logged without knowing the offender’s identity (a vehicle with only a plate number), and a system requiring party identification will not permit logging it at all.
Contractor Violations: The Strictest Documentation
This route was covered in detail in the contract violations article; the practical summary here:
Every contractor violation needs a contract clause reference, field evidence, a stipulated deadline, and documented space for the contractor’s response. On recurrence, the pattern must surface in the performance report used for the renewal decision.
The distinguishing point: a contractor violation with a financial effect is not closed by remedy alone; it closes on remedy and settlement of the financial effect. Conflating the two closures produces forgotten deductions or ones applied twice.
Company and Tenant Violations: The Undertaking Route
A company operating inside the facility — a tenant, service operator or affiliated business — is not usually subject to direct contractual penalties, but is subject to site regulations.
The effective route here rests on the documented undertaking: the company is notified of the violation, submits an undertaking to correct within a period, and that undertaking is recorded in the system with its date and owner.
The undertaking’s value is that it shifts the route from confrontation to commitment. On recurrence after an undertaking, the organization’s position changes fundamentally: this is no longer a violation but a breach of a written commitment — a far stronger basis for any escalation.
Data required beyond the basics: the notified company representative, notification method, undertaking text, due date, and fulfilment status.
Visitor Violations: Speed Before Documentation
Here the priorities invert. The visitor is present now and will leave within minutes, so immediate action matters more than a complete file.
The practical route: rapid logging with minimal fields (category, location, time, photo, and an identifier where available — a plate number or access permit number), followed by immediate on-site action.
The value is cumulative, not individual. One visitor violation means nothing; a hundred of the same type at the same location means the facility needs a physical or signage change. Category and location therefore matter far more than individual identity in this type.
Where the same identifier recurs (a specific vehicle), the system should surface the recurrence so it escalates to a stronger action.
The Meeting Point: Standardized Categories
Despite the different routes, categories must stay standardized across all three types. A “storage in emergency corridor” violation is the same violation whether committed by a contractor, a company or a visitor.
This standardization is what allows the most important question: is this problem tied to a particular party or to the location itself? If the same violation recurs from different parties at the same point, the cause lies in the place rather than the people — a conclusion that becomes impossible if the three types sit in separate systems or category schemes.
Permissions and Privacy
Violation data contains information about external parties, and access must be controlled:
- Center supervisors see violations at their site only
- Contract owners see their contractors’ violations across all sites
- Management sees the aggregated level
- Personal data (photos containing faces, ID numbers) falls under tighter access controls and a defined retention period
That last point is widely neglected and the most sensitive from a compliance standpoint, particularly in visitor violations where photos may capture individuals with no contractual relationship to the organization.
How Masharef Covers All Three Types
The Masharef general violations module documents general violations and their undertakings, with management of company and visitor violations — meaning the distinction between the undertaking route and the immediate-action route is built into the product.
The contract operations module covers the contractor violation route by linking violations to clauses and financial effects. Center management links every violation to its location through Google Maps, enabling geographic recurrence analysis across all three types. User management controls each role’s access scope through Microsoft Azure integration.
Conclusion
Three parties, three routes, one category scheme. That is the equation. A single route for everyone produces poor data, while separate categories per party produce impossible analysis. Combining distinct routes with a shared category scheme is what makes the system usable and analyzable at once.
Frequently Asked Questions
How do we log a violation by an unidentified visitor?
By making the party field optional on the visitor route and relying on whatever identifier is available, such as a plate or access permit number. Requiring full identity blocks most visitor violations from being logged and forfeits the cumulative value entirely.
Is an undertaking legally binding?
That depends on its wording and the contractual framework, but its operational value does not rest on that. A documented undertaking shifts the discussion on recurrence from proving the violation to proving breach of a commitment already accepted in writing.
What if a contractor commits a violation no clause covers?
Log it as a site regulation violation on the company route rather than the contract route, and add the appropriate clause at the next renewal. Logging it as a contract violation with no clause reference weakens the entire contractual file under review.
How long should visitor violation data be retained?
A predefined period sufficient for recurrence analysis without open-ended retention, particularly for records containing photos of individuals. Setting the period in advance and enforcing it automatically beats a manual review that will not happen.