# Off-boarding & Leaver Checks
URL: https://docs.autociso.io/product/lifecycle/offboarding/
Description: Start a leaver case when someone leaves, work through the revoke tasks, and use the four item statuses to see which access is really gone and which is still detected.

When someone leaves, every account they had must go. (For new hires, see [on-boarding](https://docs.autociso.io/product/lifecycle/onboarding/).) AutoCISO opens a **leaver case** with one revoke task per
application the person can reach, then keeps checking the tasks against the latest access data — so you can tell
access that is really gone from access somebody only ticked off.

## Before you start

- You need the **Owner** or **Manager** role to start a case and complete tasks. See
  [Roles & permissions](https://docs.autociso.io/getting-started/roles-and-permissions/).
- Your plan includes Employee lifecycle — [The Seed plan or higher](https://docs.autociso.io/getting-started/plans-and-features/). Without it the page shows an upgrade prompt.
- The leaver's access should be known to AutoCISO: the more of your applications you import through
  **Operations → [Access Audit](https://docs.autociso.io/console/access/access-audit/)**, the more tasks the case can verify.

## 1. Start a leaver case

1. Open **Directory → [Employees](https://docs.autociso.io/console/directory/employees/)** and find the person.
2. Choose **Start Offboarding**.
3. In **Offboarding Initiation**, set the **Effective Termination Date** and confirm.

AutoCISO creates an active lifecycle case and adds a **Revoke access to …** task for
every asset where it currently sees access.

## 2. Work through the tasks

Open **Operations → Lifecycle (JML)** and select the [**Leaver (Offboarding)**](https://docs.autociso.io/console/operations/offboarding/) tab. The top of the page shows
**Open leaver cases**, **Outstanding items** and **Discrepancies**, and **Latest detection** with a date.

1. Find the case. Its tags summarise it — for example "2 revoked", "1 outstanding", "1 discrepancy" — or **Clean**
   when nothing needs attention.
2. Click **Show items** to see one row per access, with the columns **Access**, **Task status**, **Inventory status**,
   **Status** and **Last seen**. Task status is what someone confirmed; inventory status is what the latest access
   data shows.
3. Remove the access in the application itself, then click **Complete** on the item to mark its task done.
4. Access that was detected without a task (for example in an application imported after the case started) shows a
   hint to remove it in the source system instead. The next access scan updates its status.

## 3. Read the four statuses

Each item combines the task status and the inventory status into exactly one status:

| Status | What it means | What to do |
|---|---|---|
| **Revoked** | The access data shows the access is gone. | Nothing. |
| **Outstanding** | The access is still active and nobody has marked it done — or it is a manual step not yet done. | Remove the access, then wait for the next access scan. |
| **Discrepancy** | Someone marked the task done, but the access is still detected. A failed removal, a re-created account or stale data. | Check it first. |
| **Marked done, unverified** | Marked done by a person, with no access data either way. | Verify it if it matters. |

When a case has discrepancies, the page says so — for example "1 item was marked as done but the access is still
detected. Check it first." Use **Show only these** to filter to them, or **Needs attention** to see everything
outstanding or in discrepancy across all cases.

A case is **Clean** when it has no outstanding and no discrepancy items. The case status (open, in progress,
completed, cancelled) is shown as is: a completed case that still shows a discrepancy is exactly the signal to look
at.

**Note — Latest detection is not a scan time**

**Latest detection** is the newest time AutoCISO saw any of the access rows behind the page — not when a scan ran,
and not a promise the data is fresh. An application that is not imported or connected keeps its old date, and a
leaver's access in it will not turn **Revoked** until it is refreshed.

## Leaver case items and Offboarding violations

The **Leaver (Offboarding)** tab lists the items of each open case. People who already have the status
**Terminated** but still hold access *without* a leaver case appear elsewhere: in the [**Offboarding Violations**](https://docs.autociso.io/console/ciso-reports/offboarding-violations/)
report under **Access & Risk → CISO Reports**. Check both — the report catches the leavers nobody opened a case for. The same list is available to AI clients as the `access_offboarding_violations` MCP tool; the [leaver items API](https://docs.autociso.io/api/reference/offboarding-items/list/) returns case items only. Accounts nobody has used for a long time show up
in [Stale & Orphaned Accounts](https://docs.autociso.io/console/ciso-reports/stale-accounts/).

## Automate it

Your ticketing tool can read the same items with a read-only `jml:read` [API token](https://docs.autociso.io/developers/api-tokens/) ([scopes](https://docs.autociso.io/developers/access-model/#employee-lifecycle--jmlread)) and open a ticket for every new
outstanding or discrepancy item. Follow [Poll leaver items nightly](https://docs.autociso.io/api/poll-offboarding/); the endpoints
are in the [Off-boarding API](https://docs.autociso.io/api/reference/offboarding-cases/list/). Completing tasks stays in the console.