# Create Access Profiles and start an on-boarding case
URL: https://docs.autociso.io/product/lifecycle/onboarding/
Description: Define the access a new hire needs by department or job title, then start a joiner case and track whether each application is granted, pending or marked done.

When someone joins, the question is always the same: do they have everything they need, and nothing they should not? This guide shows how to describe the access a role needs once, as an **access profile**, and then start a **joiner case** that turns the matching profiles into a To-Do list you can track until every application is in place.

You will:

1. Create an access profile.
2. Start a joiner case for a new employee.
3. Work through the To-Do list.
4. Keep the case up to date, change its due date, or cancel it.

When someone leaves, the reverse runs as a leaver case — see [Off-boarding & Leaver Checks](https://docs.autociso.io/product/lifecycle/offboarding/).

**Note — Who can do this**

You need the [**Owner** or **Manager** role](https://docs.autociso.io/getting-started/roles-and-permissions/) to create profiles and joiners and to change a case. Other roles do not see the buttons that change things. Your plan must include Employee lifecycle ([The Seed plan or higher](https://docs.autociso.io/getting-started/plans-and-features/)); without it the page shows **Employee lifecycle is not in your plan** with a **View plans** link.

## Before you start

- The employee exists in AutoCISO (add them under **Directory → [Employees](https://docs.autociso.io/console/directory/employees/)** if not). A joiner case is for an employee who has not left the company.
- The applications they need exist as assets (**Directory → [Assets](https://docs.autociso.io/console/directory/assets/)**). A profile lists assets, so an application that is not in AutoCISO cannot be required by a profile.

## 1. Create an access profile

An access profile says: "employees who match these attributes need this access."

1. In the sidebar, open **Operations → [Lifecycle (JML)](https://docs.autociso.io/console/operations/lifecycle/)** and select the [**Access Profiles**](https://docs.autociso.io/console/operations/access-profiles/) tab.
2. Click **New access profile**.
3. Enter a **Name**, for example `Engineering`. Names must be unique; a clash shows "An access profile with this name already exists." A **Description (optional)** helps the next person.
4. Decide who it applies to under **Applies to**:
   - To match by attribute, click **Add criterion** and choose **Department**, **Job title**, **Employment type**, **Country** or **Office**, then enter one or more values. An employee matches when every listed attribute matches one of its values. The dialog shows how many current employees match ("Matches 4 current employees").
   - To give the same access to everyone (a "base" profile such as email and chat), turn on **Applies to every employee**. The dialog warns "This profile applies to every employee." and the list shows an **Applies to everyone** tag.
5. Under **Required access**, select the assets the profile requires. At least one is needed ("Select at least one asset.").
6. Leave **Enabled** on, and click **Save**. You see "Access profile saved".

**Tip — Not sure which access a role needs?**

On the **Joiner (Onboarding)** tab, open the **Suggest access for a job title** panel at the bottom, enter a **Target Job Title** and click **Generate Profile**. AutoCISO lists the applications that most current employees with that title already have. Use it as a starting point for the **Required access** of a profile.

### Keep profiles accurate

- The **Access Profiles** list shows each profile's **Applies to**, **Access**, **Employees matched** and **Updated**. Use the pencil icon to edit and the bin icon to delete.
- An **Asset removed** tag means an application in the profile no longer exists. Open the profile and remove it from the list.
- If someone else saved the profile while you were editing, you see "This profile was changed by someone else. Reload to see the latest version." Click **Reload**, then redo your change.
- Deleting a profile does not touch existing To-Do lists: "Joiner To-Do lists already created keep their items." New joiners just stop getting that requirement.

## 2. Start a joiner case

1. Open the [**Joiner (Onboarding)**](https://docs.autociso.io/console/operations/onboarding/) tab.
2. Click **New joiner**.
3. Choose the **Employee**. Optionally set the **Due date**, the date by which the access should be ready.
4. Check the preview under **Access this joiner will get**: it shows the **Matching profiles** and the applications they require. If no profile matches, you see "No access profile matches this employee. The To-Do list will be empty." with a **Manage access profiles** link; add or adjust a profile first.
5. Click **Create joiner**. You see "Joiner created", and the new joiner appears in the list.

Things that can stop you:

- "This employee already has an open case." An employee can have only one open joiner case at a time. Click **Open the existing case** to go to it.
- "This employee cannot be onboarded because they have left the company."

## 3. Work through the To-Do list

The **Joiner (Onboarding)** tab shows **Open joiners**, **Pending access items** and **Marked done, not yet detected** at the top. Use the **Show joiners** filter to switch between **Open**, **Completed** and **All**. A joiner past their due date with access still pending gets an **Overdue** tag.

1. Click **Show To-Do list** on a joiner to expand it. Each row is one application, with its **Source** (the profiles that require it, or **Manual task**), its **Status** and a **Detail** column.
2. Give the person the access in the application itself. AutoCISO checks your access data and turns the item **Granted** on its own once it sees the access, usually after the next access scan. You do not have to click anything.
3. If you gave the access but AutoCISO cannot see it yet (an application that is not connected, for example), click **Mark as done**, write a short **Note** saying how you confirmed it (up to 500 characters) and click **Save**. The item becomes **Marked done** and shows who did it and when, with "Waiting for the next access scan".
4. Made a mistake? Click **Undo done**. The item goes back to **Pending**, and a completed case is reopened.
5. For a **Manual task** (a step that is not an application), click **Complete** when it is done.

The case completes by itself when every item is **Granted** or **Marked done**.

| Status | Meaning |
|--------|---------|
| **Granted** | The access is detected in your access data. |
| **Pending** | No access detected and nobody has marked it done. |
| **Marked done** | A person confirmed it, but AutoCISO does not see it yet. |

**Note — Notes are for your team**

The note you write when marking an item done is shown on the To-Do list to **Owners** and **Managers**. Do not put passwords or personal details in it.

## 4. Keep the case up to date

- **Refresh from profiles.** If you change a profile or the employee's department or job title after the case was created, open the joiner and click **Refresh from profiles**, then confirm. The profiles are checked again with the employee's current details, and new required access is added to the list with a **New** tag. Nothing is removed or changed. You see "2 items added" or "Already up to date".
- **Edit due date.** Click the pencil icon (**Edit due date**), pick a date and click **Save**.
- **Cancel case.** Click the ban icon (**Cancel case**) and confirm. "Remaining items stop being tracked. This cannot be undone."

If a case is completed or cancelled you see "This case can no longer be changed." If someone else changed an item while you were looking at it, you see "This item was changed by someone else. Reload and try again."

## The same data over the API

Everything on the **Joiner (Onboarding)** tab can be read, but not changed, with a `jml:read` [API token](https://docs.autociso.io/developers/api-tokens/) (see [scopes](https://docs.autociso.io/developers/access-model/#employee-lifecycle--jmlread)). Use it to feed a ticketing tool with the items that are still **Pending**. See the [On-boarding API](https://docs.autociso.io/api/reference/onboarding-cases/list/).