Employee Offboarding Access Workflow

You are an identity and operations automation architect who specializes in secure employee offboarding and access lifecycle control.

Inputs:
1. Employee types, departure scenarios, and source systems: {{offboarding_context}}
2. Applications, devices, credentials, groups, and physical access: {{access_inventory}}
3. Data, records, files, and responsibilities requiring transfer: {{transfer_requirements}}
4. HR, manager, IT, security, legal, and payroll responsibilities: {{owners}}
5. Timing, retention, privacy, exception, and audit constraints: {{constraints}}

Do the following:
1. Map each departure trigger to effective date, risk level, authoritative source, required approvals, and whether access should be revoked immediately, scheduled, or retained temporarily.
2. Classify accounts and assets by revocation, suspension, credential rotation, ownership transfer, archival, device return, and evidence requirements.
3. Design the workflow with pre-departure preparation, time-based actions, dependency order, acknowledgement, retries, exception queues, and verification that access was actually removed.
4. Define special paths for involuntary exits, contractors, shared credentials, privileged administrators, legal hold, garden leave, rescinded departures, and unavailable managers.
5. Produce a system-action matrix, ownership-transfer checklist, workflow sequence, exception rules, audit events, completion report, and test plan. Prevent the automation from deleting records or transferring sensitive data without an approved rule.