---
name: offboarding-runbook
description: Run the offboarding checklist, then independently re-verify every access revocation before calling it closed. Use this skill when: Termination date confirmed — HR marks the exit, checklist kicks off.
---

# Confirm access is actually gone

Goal: run the offboarding checklist and independently confirm every access revocation actually took effect.

Connected tools this skill uses: slack, googlesheets, gmail, notion.

## When to use

- Termination date confirmed — HR marks the exit, checklist kicks off.
- Or when the user asks directly to run the offboarding checklist and independently confirm every access revocation actually took effect.

## Method

Run the offboarding checklist for {{employee}}, effective
{{termination_date}}.

1. Build the access checklist from the {{role_type}} inventory: every
   system, account, and permission level on file for this role.
2. For each item, trigger revocation directly where the agent has a
   system connection, or open a ticket to {{it_owner}} with the deadline
   set to {{termination_date}}.
3. Wait {{reverify_delay_hours}} hours after each revocation action, then
   independently re-check that system directly. Do not trust the trigger
   call or the ticket status alone.
4. Validation: mark an item confirmed only if the independent
   re-check shows access is actually gone. Anything not independently
   confirmed stays unconfirmed, never assumed closed.
5. Escalate every item still unconfirmed {{escalation_hours}} hours after
   {{termination_date}} to {{security_escalation_channel}} immediately —
   lingering access past this point is a security incident, not a
   routine follow-up.
6. Post the confirmed-vs-unconfirmed report to {{delivery_channel}} and
   update the offboarding-runbook tracker view.

Never mark an access-revocation item closed on the basis of a triggered
action alone, only an independent re-check confirms it, and any
employee-specific detail in the report stays inside People Ops and
Security, never a shared channel.

## Access inventory by role

Map every system and permission level a role type typically holds, so the checklist starts complete.

## Method
1. Look up the {{role_type}} access inventory stored in memory.
2. List every system the role type has access to, with its permission level.
3. Cross-check the inventory against the departing employee's actual account list where available.
4. Flag any system on the employee's account list that the standing inventory doesn't cover.
5. Add newly discovered systems to the standing inventory for future exits.
6. Hand the finalized per-employee checklist to the revocation-execution step.

## Rules
- Store and reuse role-type inventories in memory (set on first run, then stored in memory); update them as systems are added.
- Cross-check the standing inventory against the employee's actual accounts — do not rely on the template alone.
- Flag any system found on the employee's accounts but missing from the inventory before revocation starts.
- Never omit a system from the checklist because it wasn't in the original template.

## Output
A per-employee access checklist: one row per system and permission level, sourced from the role-type inventory plus any employee-specific additions.

## Revocation execution

Trigger or ticket revocation for every checklist item, with a clear deadline on each.

## Method
1. Take the finalized access checklist for the departing employee.
2. For each item, check whether the agent has a direct system connection.
3. Where a direct connection exists, trigger the revocation action.
4. Where none exists, open a ticket to {{it_owner}} with the deadline set to {{termination_date}}.
5. Record the action taken and its timestamp for each item.
6. Pass the full checklist, with actions logged, to the independent re-verification step.

## Rules
- Set every ticket's deadline to {{termination_date}} — no open-ended tickets.
- Record the exact action and timestamp per item; an untracked action can't be re-verified.
- Never mark an item closed at this step — execution only confirms the action was sent, not that it worked.
- Route tickets to {{it_owner}} (set on first run, then stored in memory) for anything outside the agent's direct reach.

## Output
An action log: one row per checklist item, the action taken — triggered or ticketed — and its timestamp, ready for re-verification.

## Independent re-verification

Independently confirm each access revocation actually took effect — never trust the trigger call or a closed ticket alone.

## Method
1. Wait {{reverify_delay_hours}} hours after each revocation action.
2. Query the source system directly for that item — not the ticket status, not the trigger's return value.
3. Compare the system's live state against "access revoked" for that account and permission level.
4. Mark the item confirmed only when the direct query shows access is actually gone.
5. Mark anything the direct query can't confirm as unconfirmed — never assume closed.
6. Escalate any item still unconfirmed {{escalation_hours}} hours after {{termination_date}} to {{security_escalation_channel}}.
7. Compile the confirmed-vs-unconfirmed report for delivery.

## Rules
- A closed ticket is not proof of revoked access — query the system directly, every time.
- Use confirmed and unconfirmed as the only two states; there is no assumed-closed state.
- Escalate unconfirmed items past {{escalation_hours}} hours (set on first run, then stored in memory) as a security incident, not a routine follow-up.
- Keep the report inside {{security_escalation_channel}} — People Ops and Security only, never a shared or broad channel.

## Output
A confirmed-vs-unconfirmed report: one row per access item, its verification state, and the source-system check that produced it — delivered to a restricted channel only.

## Recurring jobs

This skill pairs with scheduled jobs. Offer to set each one up; only create the ones the user approves:

- Offboarding request watch (Daily poll for a newly confirmed termination date) — https://eluu.ai/cookbook/offboarding-runbook/jobs-setup/offboarding-request-watch.md
- Access re-verification pass (Runs {{reverify_delay_hours}} hours after each revocation action) — https://eluu.ai/cookbook/offboarding-runbook/jobs-setup/access-re-verification-pass.md