01
Joiner
- Birthright access by role and department when the account is created
- The directory change is the trigger
Day one to last day
A leaver stops being reachable on the day they leave.
Govern, joiner, mover, leaver
Their last day was Friday. On Monday the sessions are still live, the groups still list them, and the OAuth grants never expired.
For IT operations, on both ends of the org chart.
What the industry reports
- 45%of former employees admit signing back in to view, take or delete dataPonemon Institute, 2025
- 32%of organizations take more than seven days to fully deprovision a leaverOneLogin, IT decision-maker survey
What changes
The directory change is the trigger
The run starts when employment ends in the directory, with no ticket in between.
One run strips everything
Sessions, groups, application assignments, directory roles and OAuth grants. Five kinds of access that usually need five people.
An unsupported step says so
Where a connector cannot do something, the step is skipped with its reason on the record.
Everything this covers.
02
Mover
- Out of the groups and applications the old job needed
- Into the ones the new job does, in the same run
03
Leaver
- Sessions, groups, app assignments, roles and OAuth grants in a single run
- A step a connector cannot do is skipped with its reason
04
Evidence
- Workflows versioned, with a snapshot of the version that ran
- A record per step: what ran, what changed, what failed
- Notified in the product, by email, on Slack or by webhook
The parts of the product this uses.
Lifecycle automationAccess arrives on the hire date and ends on the last one
Policies and workflowsThe rule that keeps access correct runs itself
Access reviewsReviewers decide with the evidence in front of them