Sixty-second termination revoke is a control, not a marketing number

Most operations leaders agree onboarding matters and treat it accordingly. Most operations leaders agree offboarding matters and do not treat it accordingly. The asymmetry is exactly why the offboarding workflow is the single most valuable surface the platform exposes, and why sixty-second revoke is a control rather than a marketing number.

The hire ships in twelve days and the worst case is the new employee waiting three days for their laptop. The leaver leaves accounts active across Workspace plus Slack plus GitHub plus Okta plus Microsoft 365 plus AWS plus 1Password plus the rest, and the worst case is somebody compromises one of those accounts six months later. The asymmetry shows up at the moment somebody asks the company how the breach happened.

The architecture under the sixty-second number is specific. The terminate endpoint creates the revocation queue rows inside the same database transaction that flips the employment record. A Celery beat worker picks rows up with FOR UPDATE SKIP LOCKED so multiple workers can drain the queue in parallel without stepping on each other. Each adapter implements get_user_risk_summary plus revoke. Suspicious activity gates on a human approval. Clean rows revoke and write one audit log entry. The dashboard subscribes to the SSE stream and renders progress in real time.

The reactivation pipeline is the part the build-your-own-Slack-bot category cannot replicate. Rehire fires the same architecture in reverse. The orchestrator that does not own the employee table cannot reactivate on rehire because it does not know who got rehired. The system of record plus orchestrator combined is the only architecture that closes both ends of the loop.