A security guard is asked by a cashier to help bring down an item from a tall shelf. He agrees, skips using a ladder, and gets hurt. He files a workers' compensation claim against his employer, the security company, and then sues the store in a separate action. This is an example of real-life litigation, and it shows one of the most common and avoidable sources of lawsuits for security guard companies and the businesses that hire them: guards doing tasks that fall outside their security contract.

The Scope-of-Work Problem

Security guard companies exist to provide one narrow set of services: deterrence, observation, patrol, and reporting. Client contracts are written to limit the guard's role to security tasks and usually bar the guard from taking on the client's day-to-day operational work. But what is written in a contract and what happens in real life don't always match. Cashiers, managers, and other client employees do not always know, or respect, the limits of the security contract. And guards, wanting to be helpful or worried about upsetting the client, may not advocate for themselves.

That gap is where lawsuits are born. In the fact pattern described above, the contract did not authorize the guard to do store operations work, such as pulling merchandise off shelves or handling shopping carts and baskets. Still, when a cashier asked the guard to help bring down a basket, he agreed and was injured.

The Privette Doctrine: The Starting Point

When an independent contractor's employee, such as a contracted security guard, gets hurt on a client's property, the analysis almost always starts with the Privette doctrine. Under Privette v. Superior Court and the cases that followed it, a business that hires an independent contractor is generally protected from lawsuits by the contractor's employees. The idea is that the business has handed off responsibility for workplace safety to the contractor, who is in a better position to control how the work gets done and who already carries workers' compensation coverage for its own employees.

The doctrine has three well-known exceptions. 

1. First, the "retained control" exception applies if the hirer keeps control over how the work is done and uses that control in a way that affirmatively contributes to the injury. 

2. Second, the "concealed hazard" exception applies if the hirer knows of a hidden, pre-existing dangerous condition and fails to warn the contractor about it, and the contractor could not have reasonably discovered the dangerous condition. 

3. Third, liability can attach if the hirer supplies unsafe equipment that contributes to the injury, and the contractor was required to use the supplied equipment. Each of these would need to be independently analyzed on a case-by-case basis. 

Why Scope of Work Is the Real Battleground

The Privette doctrine only applies if the injury happens while the contractor's employee is doing the work that was actually contracted. That single idea is the driving force in every Privette-related matter.

In the fact pattern presented at the beginning of this article, the defense (aka the store and security company) would argue that Privette clearly applied: the guard was an employee of the security company, the security company had a contract with the retailer, and the guard was pursuing a workers' compensation claim for the same injury. On that view, the case should end there. Since the security contract did not cover the activity the security guard engaged in, Privette does not apply. We will take a look at this in more detail below. 

The "Retained Control" Exception: A Closer Look

Security contracts are for security services, not for store operations tasks like retrieving items from shelves. Relying on applicable case law, such as Sandoval v. Qualcomm Incorporated, a case that repeatedly distinguishes between "contracted work" and "non-contract work," says a hirer's authority over non-contract work does not by itself create a retained-control duty, while Hooker v. Department of Transportation requires more than just the theoretical right to control the work. Even if Privette applies, there are exceptions wherein a plaintiff can still recover if the hirer retained control over the work and exercised that control in a way that affirmatively contributed to the injury. The hirer has to actually get involved in the work, and that involvement must affirmatively contribute to the injury, not just fail to prevent it.

A recurring argument in cases like this is that an employee's subjective sense of obligation can transform an informal request into something closer to a directive. If a worker treats a request from client personnel as effectively coming from a supervisor, and fears consequences for refusing, plaintiffs will argue that this dynamic reflects retained control.  

This argument would be countered by isolating the issue down to its roots: a guard has no duty to accept non-security tasks from other client employees, and that, without more, would not convert an informal request into the kind of control or direction the retained-control exception requires. It would make sense to argue that a single request for help from a cashier, which the guard could have declined, does not amount to the kind of control that strips away Privette's protection. However, this is not always successful when the task is clearly not security-related.

The Bottom Line for Security Companies

Despite the arguments relating to the small scope of the request to the security guard, and the guard's decision on how to complete the request, the court ultimately decided Privette did not apply. The court relied on the contract's black-and-white language, and because the task requested of the security guard was not part of the scope of work, Privette didn't apply. 

It is imperative that security guards are educated and understand their actual duties. They should be trained to know what they should and should not do at their designated location, and specifically who they should accept specific tasks from. 

The scope of work is not just a contract-drafting exercise. It is the single fact that can decide whether Privette protects a security company's client at all, and whether the hirer's own conduct, however minor it seems in the moment, can be recast as "control" that led to an injury.

Operational Protocols That Reduce This Exposure

1. Guards need to know exactly what they were hired to do and when they can say "No"

Guards should be able to say, without hesitation, whether their job is to observe and report, act as a visual deterrent, protect property, or something more. Just as important, a guard needs to know what they were not hired to do, and how to comfortably say no. Guards should be trained to recognize when tasks fall outside their scope of work.

2. Guards must know whose employee they are

Guards are stationed at a client's work site for the security company, not the client. Guards who lose sight of that are the ones most likely to take on tasks outside their job, sometimes in direct conflict with the contract that placed them at the site. Security companies should make it abundantly clear that client staff have no authority to assign a guard's duties.

3. Keep logs of every deviation from the post order, no matter how small

These cases often turn on the guard's own deposition testimony about how often non-security tasks were requested or completed, and how they felt about their relationship with store staff. Notes taken at the time protect a security company's position far better than testimony reconstructed after an injury. Guards should log every time a client employee asks them to do something outside their contracted duties, including the date, who asked, how the guard responded, and whether anyone got hurt.

Why This Matters Beyond One Case

Security guard companies work on thin margins and thinner public goodwill. Guards are often viewed with skepticism, fairly or not, and plaintiffs' firms are quick to pair that skepticism with claims of negligent hiring, training, or supervision. A guard who steps outside the security contract to help a client's staff may seem like a small favor. This case shows it is anything but small: it can call into question the Privette doctrine's protection, expose both the security company and its client to negligence and premises liability claims, and turn a routine favor into years of costly motion practice and litigation.

The fix is not complicated, but it takes discipline. Guards need to know exactly what they are hired to do, exactly what they are not, and exactly how to say no when asked to cross that line. Security companies that build this into training, supervision, and documentation protect their clients' legal position and their own.