# Employee Offboarding Access Workflow

Design a coordinated offboarding automation that revokes access, transfers ownership, preserves records, and verifies completion without locking out active teams.

## Prompt

You are an identity and operations automation architect who specializes in secure employee offboarding and access lifecycle control.

Inputs:
1. Employee types, departure scenarios, and source systems: {{offboarding_context}}
2. Applications, devices, credentials, groups, and physical access: {{access_inventory}}
3. Data, records, files, and responsibilities requiring transfer: {{transfer_requirements}}
4. HR, manager, IT, security, legal, and payroll responsibilities: {{owners}}
5. Timing, retention, privacy, exception, and audit constraints: {{constraints}}

Do the following:
1. Map each departure trigger to effective date, risk level, authoritative source, required approvals, and whether access should be revoked immediately, scheduled, or retained temporarily.
2. Classify accounts and assets by revocation, suspension, credential rotation, ownership transfer, archival, device return, and evidence requirements.
3. Design the workflow with pre-departure preparation, time-based actions, dependency order, acknowledgement, retries, exception queues, and verification that access was actually removed.
4. Define special paths for involuntary exits, contractors, shared credentials, privileged administrators, legal hold, garden leave, rescinded departures, and unavailable managers.
5. Produce a system-action matrix, ownership-transfer checklist, workflow sequence, exception rules, audit events, completion report, and test plan. Prevent the automation from deleting records or transferring sensitive data without an approved rule.

## Best for

HR, IT, and security teams automating departures while protecting data, continuity, and access-control evidence.

## Compatible tools

- Claude
- ChatGPT

## How to use

- Inventory every account and resource type.
- Define departure scenarios and effective times.
- Name authoritative owners for transfers and exceptions.
- Test rescinded and involuntary departures before launch.

## Customization tips

- Separate access revocation from data retention.
- Require provider confirmation for critical actions.
- Rotate shared credentials explicitly.
- Add a manual emergency path for unavailable systems.

## Example input

Context: 650-person engineering company using Workday as the employee source, Microsoft Entra ID, Google Workspace, GitHub, AWS, Jira, Slack, and managed laptops. Departures: voluntary, involuntary, contractors, and internal transfers. Transfers: repositories, cloud resources, calendars, shared drives, and open approvals. Constraints: privileged access revoked within five minutes for involuntary exits, mail retained for 90 days, legal holds override deletion, and managers confirm file ownership.

## Example output

The design uses the approved Workday event as the trigger, separates immediate privileged revocation from scheduled standard deactivation, and transfers resource ownership before account suspension where safe. Shared secrets create rotation tasks rather than being silently ignored. Legal hold blocks deletion but not access removal. The completion report reconciles every expected account against provider confirmation and sends failures to an owned exception queue.