Skip to content
← All use cases

Offboarding everywhere

When someone leaves, every kind of access ends together.

One leaver request ends access to the directory, apps, data grants, doors and cloud resources, with the approvals and evidence in one record and every destructive step held for a person.

For IT, HR, Security

Download the brief(PDF)

Start freeTalk to us
Investigator console
The trace of an access review: reading the finance lead’s grants was allowed, and revoking a grant was held for human approval, with the reason recorded for each step.The trace of an access review: reading the finance lead’s grants was allowed, and revoking a grant was held for human approval, with the reason recorded for each step.
Every step recorded; the destructive one waits for a person. Shown with demo data.

The situation

A leaver is a ticket per system: the directory, the SaaS apps, the data grants, the badge, the cloud account. One is always forgotten, and nobody can show afterwards that all of them ended on the same day.

How it works

Step by step, and the product each step happens in.

  1. 01

    HR raises the leaver

    A structured leaver request names the person and the date, from the HR system or by hand.

    In Lifecycle
    Admin console
    The Lifecycle work queue in the admin console: a completed joiner and leaver with every provider step listed, a joiner approved by the manager and waiting on IT, and a mover waiting on both.The Lifecycle work queue in the admin console: a completed joiner and leaver with every provider step listed, a joiner approved by the manager and waiting on IT, and a mover waiting on both.
    Every joiner, mover and leaver with its approvals and the steps it ran. Shown with demo data.

  2. 02

    The manager and IT approve

    Both approvals are recorded against the request before anything changes.

    In Lifecycle

  3. 03

    Access ends across the pillars

    The offboarding agent revokes data grants, disables the account, revokes camera and door access and deprovisions cloud resources in one traced run. Each destructive step waits for a person.

    In Workflows & Agents
    Investigator console
    The trace of an access review: reading the finance lead’s grants was allowed, and revoking a grant was held for human approval, with the reason recorded for each step.The trace of an access review: reading the finance lead’s grants was allowed, and revoking a grant was held for human approval, with the reason recorded for each step.
    Every step recorded; the destructive one waits for a person. Shown with demo data.

  4. 04

    Every step can be retried or undone

    Execution is idempotent, a failed step retries, and a step that must be reversed is compensated rather than left half-done.

    In Lifecycle

What you get

  • One record of the whole leaver

    The request, both approvals and every step it ran are in one place.

  • Nothing destructive without a person

    Revocations and deprovisioning wait for approval, and the agent can never exceed its own permissions.

  • Four pillars in one run

    Identity, data, physical access and cloud end together rather than ticket by ticket.

The products involved

Questions, answered

Does it work with our HR system?

Lifecycle reads joiners, movers and leavers through an HR provider port. A BambooHR-shaped driver is included, and requests can also be raised directly.

What stops the agent revoking the wrong thing?

Each destructive step is held for a person, a blast-radius limit caps how many it may take in one run, and every step is authorized against policy before it acts.

Related use cases

Offboarding everywhere · ProjectX