How do you fully cut off access the day someone leaves?
An offboarding AI Employee that checks for newly marked departures on a schedule and works the full checklist across SSO, Workspace, Drive, and GitHub, revoking access, transferring ownership, and reclaiming licenses, while the ownership transfer pauses for a named human's signature and no account is ever deleted.
×
Offboarding is a checklist that has to run to completion. When someone leaves, their access has to be pulled from every system they touched, their documents and repositories have to change hands, and their licenses have to come back, across SSO, Workspace, Drive, and GitHub, each with its own steps, done in the right order, on the same day. The steps are simple; the risk is in the ones that get skipped. Miss one and a former employee keeps a login, a shared drive loses its owner, or a paid seat sits unused. The common approaches leave gaps. A written runbook depends on someone working it by hand under time pressure, and a missed line is a live account no one notices. A provisioning tool covers SSO but not document ownership or repository access. IT tickets spread the work across people and days, and the parts that are easy to forget are exactly the ones that matter for security.
The offboarding AI Employee checks the SSO group HR adds departing employees to on a schedule, inside your own environment, and works the checklist for every departure it finds: revoke SSO and app access, remove the person from the GitHub org, transfer document and drive ownership, and reclaim licenses. Reversible steps run on their own; the ownership transfer pauses for a named human's signature before it executes. Account deletion is out of scope entirely, never attempted, gated or otherwise. It posts a completed checklist showing what it did and what is still pending.
See exactly how the work gets done.
Checks for departures on a daily schedule
A scheduled run checks the SSO group HR marks departing employees into, so access comes down the same day a departure is logged. Each run starts clean, and if it finds more than one departure, each is worked as its own independent case.
Works to your offboarding checklist
Your offboarding policy travels with the AI Employee as a skill: the full list of systems, the order to work them in, which steps are reversible and which are not, and how ownership should be reassigned. Add a tool or change the policy and it picks that up on the next departure.
Connects to your systems, with permissions you set
It deactivates the SSO account and pulls the app assignments that hang off it, so Slack access drops the moment SSO is revoked where Slack is connected through SSO. It then removes the person from the GitHub org and its teams, reassigns Drive ownership then suspends the Workspace account, and releases paid seats back to the pool. Credentials stay in memory, never written to disk, never exposed to the model.
Pauses for a named human on the ownership transfer
The reversible steps run on their own. Transferring ownership away from a person stops for a named human's signature before it executes. Account deletion is never performed, gated or otherwise. It hands off to a person if a deletion is ever genuinely needed.
Runs the checklist to completion
Each departure becomes one worked case: SSO revoked, GitHub access removed, ownership transferred, licenses reclaimed. It posts a completed checklist showing every step it took and anything still pending a person, so nothing is left half done.
Runs in your environment
Every departure case is isolated inside your own infrastructure. It can reach only the systems it's scoped to, and only the checklist result leaves it.
Ownership transfer waits for a signature
Transferring ownership away from a person pauses for a named human's signature before it runs. The reversible revocations run on their own; the irreversible handoff does not.
Never deletes an account
Account deletion is out of scope entirely, never performed, gated or otherwise. It hands off to a person if a deletion is ever genuinely needed.
Credentials stay contained
The SSO, Workspace, Drive, and GitHub credentials connect with the permissions you set, stay in memory, are never written to disk, and are never exposed to the model or the logs.
You own every rule
The checklist, the skills, and the per system permissions are yours, versioned and changed on your terms, not in a vendor dashboard.
Access that used to depend on someone working a runbook by hand now comes down the same day a departure is marked, with ownership transferred and licenses reclaimed in the same run. The ownership transfer waits for a named human, and the completed checklist shows exactly what happened and what is still pending. The AI Employee runs the checklist; your people sign off on what crosses a line.
Every departure
The full checklist run across all systems, same day
0 deletions
No account ever deleted; the ownership transfer held for a named human
4 systems
SSO, Workspace, Drive, and GitHub reconciled in one run
Our free AI audit shows you where AI fits, what your security risks are, and gets your first AI employee working.
How do you get a verdict on reported phishing within 15 minutes?
Pulls each newly reported email, inspects its headers, links, and attachments for phishing indicators, and posts a risk verdict with a recommended action to your security channel. It reads and recommends, and never blocks, deletes, or remediates.
×
How do you catch compliance drift the day it appears?
Sweeps cloud infrastructure against policy daily, files each drift finding to Slack, and proposes remediation as a reviewed change. It detects and proposes; a named human applies the fix.
×How do you grant least privilege access without the wait?
Checks each access request against policy, scopes it to the least privilege that unblocks the work, and prepares the grant, applying nothing until a named human signs off, with a record left behind.
×