Employee access revocation
Help remove access when an employee leaves.
When your HR system records a departure, Deixic helps remove the person’s access across your connected tools. It follows your offboarding policy, asks for the required approvals, and checks that access is gone. Then it adds the evidence to the SOC 2 control.
Employee departure
Close CC6.2: disable employee@example.com and revoke access in Google Workspace, GitHub, and AWS
- Identity
- offboarding-agent · People operations
- Target
- employee@example.com
- Cost
- Recorded agent cost
- Evidence
- Effective time, HR record, access inventory, and read-back checks
Policy decision
Employee account disablement requires the People operations owner.
- Approver
- People operations owner
The tool call waits for its approval owner.
Put the decision before execution.
Execution order: the routed request reaches company policy before the connected tool runs.
- 01 · Request
Confirm the employee.
Selecting the wrong identity locks out an active employee; a partial revoke leaves access behind and keeps CC6.2 failing.
- 02 · Authority
Name the approval owner.
Employee account disablement requires the People operations owner.
- 03 · Result
Keep the tool result.
Record the request, decision, and execution result in activity history.
Follow the HR record into connected systems.
The compliance procedure reads terminations and revokes Google Workspace, GitHub, and AWS SSO access under company policy.
- HR departure
- Use the termination record and effective time to identify whose access changes.
- System access
- Revoke access through configured connections and verify each change.
- Control evidence
- Keep revocation evidence with the SOC 2 access provisioning and removal control.
The next departure inherits the procedure.
Save the steps and checks for reuse; the next action still needs its own identity, access, and authority.
- Procedure
- Employee identity, effective time, access inventory, revocation and verification steps.
- Policy
- Keep the company's approval boundary separate from the agent that requests the work.
- Evidence and tests
- Retain the decision and result; replay sessions to check changes to the procedure.
Execution requires a configured tool with provider permissions for this action. Review connector operations
Before you connect production work
Where does the departure record come from?
The compliance workflow reads HR terminations. Its offboarding procedure revokes Google Workspace, GitHub, and AWS SSO access and keeps evidence with the control.
See compliance executionWho decides when access is revoked?
Your company sets the access revocation deadline and policy. Changes that require a person wait for the named approval owner.
Set approval boundariesWhat do we retain for the next departure?
Keep the reviewed revocation procedure, connected-system access, and checks. Each departure retains its own employee record, authorization, and results.
Review reusable procedures