But what's not allowing access for compliance reasons and that's it? There should be a form where he can request access if he thinks he can pull off an implemen

But what's not allowing access for compliance reasons and that's it? There should be a form where he can request access if he thinks he can pull off an implementation in days of something that takes months otherwise. I worked in big and very big corporations and cut through PCI, HIPPA, and lots of those with requests like that. That they have forms and scheduled for a month in the future (assuming second half of December doesn't exist which is reasonable) is good. But that there's no process to get access to their code and figure our what's going on is not ok. Specially if they are an infra team.