How to automate employee offboarding
Most onboarding gets attention. Most offboarding does not, and the asymmetry is exactly why the offboarding workflow is the single most valuable surface in the platform. The sixty-second revoke is achievable because the work fans out in parallel against the same authorization model the customer already grants.
What the agent revokes, and in what order
Workspace mailbox suspend with ownership transfer. Slack deactivate on Enterprise Grid. GitHub PAT and SSH key revocation plus deploy key rotation. Okta global token revocation. Microsoft 365 sign-in disable plus mailbox handoff. AWS IAM key deactivate plus MFA detach plus console disable. 1Password vault removal. Bitwarden removal. Notion ownership transfer. Linear issue reassignment. Figma seat reclaim. Plus the embedded payroll deactivation, the equipment recovery ticket, and the parent HRIS update. Fourteen systems on one trigger.
The per-adapter risk summary
Before the agent revokes, each adapter returns a risk summary describing what the user touched recently. Suspicious activity gates on a human approval before revoke fires. The pattern catches the case where the user is leaving under contentious circumstances and the manager wants the revoke to coincide with a forensic snapshot, not run independent of one.
The reactivation mirror on rehire
Rehire fires the same fan-out in reverse. New employment record writes, reactivation queue rows fan out across the same fourteen adapters, and the dashboard streams progress on the same surface. The architecture closes both ends of the loop, which is the part the build-your-own-Slack-bot category cannot replicate without owning the system of record.
What the audit log looks like
Fifteen rows. Fourteen adapters plus the trigger. Each row records the timestamp, actor, target system, action, result, and the risk summary. Hash-chained. SOC 2 evidence packs lift these rows directly. The auditor reads them and signs them.
Frequently asked
What if a downstream adapter fails?
The adapter retries on standard backoff, escalates on the second failure, and writes the failure to the audit log. The other adapters in the fan-out are not blocked.
Can we customize the revoke list?
Yes, per role. Admins, contractors, and standard employees get their own fan-out shape.
Keep reading
How to automate employee onboarding
Most onboarding workflows still run sequentially because that is how the spreadsheet was written. Run them in parallel and the calendar drops from twelve days to thirty minutes.
What is joiner, mover, leaver (JML)
JML is the lifecycle of a user account from hire through role changes through exit. It is the single highest-volume IT category and the one most ripe for automation.