Off-boarding & Leaver Checks

When someone leaves, every account they had must go. (For new hires, see on-boarding.) AutoCISO opens a leaver case with one revoke task per application the person can reach, then keeps checking the tasks against the latest access data — so you can tell access that is really gone from access somebody only ticked off.

Before you start

• You need the Owner or Manager role to start a case and complete tasks. See Roles & permissions.
• Your plan includes Employee lifecycle — The Seed plan or higher. Without it the page shows an upgrade prompt.
• The leaver’s access should be known to AutoCISO: the more of your applications you import through Operations → Access Audit, the more tasks the case can verify.

1. Start a leaver case

1. Open Directory → Employees and find the person.
2. Choose Start Offboarding.
3. In Offboarding Initiation, set the Effective Termination Date and confirm.

AutoCISO creates an active lifecycle case and adds a Revoke access to … task for every asset where it currently sees access.

2. Work through the tasks

Open Operations → Lifecycle (JML) and select the Leaver (Offboarding) tab. The top of the page shows Open leaver cases, Outstanding items and Discrepancies, and Latest detection with a date.

1. Find the case. Its tags summarise it — for example “2 revoked”, “1 outstanding”, “1 discrepancy” — or Clean when nothing needs attention.
2. Click Show items to see one row per access, with the columns Access, Task status, Inventory status, Status and Last seen. Task status is what someone confirmed; inventory status is what the latest access data shows.
3. Remove the access in the application itself, then click Complete on the item to mark its task done.
4. Access that was detected without a task (for example in an application imported after the case started) shows a hint to remove it in the source system instead. The next access scan updates its status.

3. Read the four statuses

Each item combines the task status and the inventory status into exactly one status:

When a case has discrepancies, the page says so — for example “1 item was marked as done but the access is still detected. Check it first.” Use Show only these to filter to them, or Needs attention to see everything outstanding or in discrepancy across all cases.

A case is Clean when it has no outstanding and no discrepancy items. The case status (open, in progress, completed, cancelled) is shown as is: a completed case that still shows a discrepancy is exactly the signal to look at.

Leaver case items and Offboarding violations

The Leaver (Offboarding) tab lists the items of each open case. People who already have the status Terminated but still hold access without a leaver case appear elsewhere: in the Offboarding Violations report under Access & Risk → CISO Reports. Check both — the report catches the leavers nobody opened a case for. The same list is available to AI clients as the access_offboarding_violations MCP tool; the leaver items API returns case items only. Accounts nobody has used for a long time show up in Stale & Orphaned Accounts.

Automate it

Your ticketing tool can read the same items with a read-only jml:read API token (scopes) and open a ticket for every new outstanding or discrepancy item. Follow Poll leaver items nightly; the endpoints are in the Off-boarding API. Completing tasks stays in the console.