Security and compliance
Offboarding, MFA, branch protection, and IAM cleanup need care and follow-through. Deixic helps make those changes within your policies, asks for the required approvals, and checks the results. The record of that work supports your audit.
Dex · Security · Oct 5, 9:12am
The decision
“A former employee still holds AdministratorAccess on production. Who removes it?”
Deixic removes the GitHub membership and deactivates the access key under your offboarding policy. Removing production admin waits for your Security owner. Deleting the account sits outside the policy and does not run.
The product
Each change records the state before, the state after, who authorized it, and a read-back from the system itself. The records are signed and hash-linked, and the evidence goes to your compliance platform.
How it works How compliance execution worksReceipt · three controls
| System | Before | After |
|---|---|---|
| Google Workspace | 2-step verification off | Enforced |
| GitHub main branch | No required reviews | Reviews required |
| AWS IAM user | Unused key active | Key inactive |
What changes
A termination in the HR system starts the removal: Google Workspace account suspended, GitHub membership removed, AWS access keys deactivated.
Deixic turns on 2-step verification enforcement for the accounts that fail the control and reads the setting back.
Repositories that fail get branch protection and required reviews, checked in GitHub after the change.
Unused access keys are deactivated within policy. Admin access on production goes to an approver.
Sensitive changes wait for a named approver. Actions outside your policy are refused or sent to you as a decision.
Before and after state, the authorizing person, the read-back checks, and the signed, hash-linked record attach to the control.
Common questions
Low-risk changes inside the policy you grant, such as deactivating an unused access key. Sensitive changes, such as removing production admin access, wait for a named approver.
Actions outside your policy, such as deleting an account. Deixic refuses them or sends them to you as a decision.
No. Connect the one you have. Deixic reads its failing tests, uploads evidence to it, and re-runs the tests there.
Yes. Policy, permissions, and approval boundaries sit outside the agent, so actions from any agent routed through Deixic meet the same rules and leave the same record.
For security and compliance