01 the business
Home care provider
350 staff, high turnover
Carers start without logins for the rostering app. Leavers keep access to client records for weeks because nobody told IT. The steps change depending on who handles them.
02 before
The problem
New starters often turn up on day one with no laptop login and no email. Leavers keep access to the CRM or the shared inbox for weeks because nobody told IT. The steps live in someone's head, so they change depending on who is in that week.
- New starters wait days for accounts.
- Leavers keep access after they go.
- No consistent checklist exists.
03 the build
What the AI does
- Step 1: Watches BambooHR or Workday for new hires, role changes and leaving dates.
- Step 2: Builds a setup plan from the person's role: mailbox, groups, app seats and device, using your role templates.
- Step 3: Creates the accounts in Google Workspace or Microsoft 365 and adds the person to the right Okta groups and Slack channels.
- Step 4: For leavers, schedules account suspension for their last working hour, moves mailbox and file ownership to the manager and lists apps that need manual removal.
- Step 5: Raises a Jamf or Intune task to ship, wipe or collect the laptop.
- Step 6: Posts a finished checklist to the hiring manager and keeps it on file.
paused: waiting for a person to approve
How it was put together
- Watched the HR system for hires, role changes and leaving dates.
- Built setup plans from role templates: mailbox, groups, app seats and device.
- Created accounts and group memberships, and raised device tasks.
- Scheduled leaver suspension for their last working hour and moved file ownership to the manager.
04 human in the loop
Where a person stays in charge
The line manager confirms the role template before any accounts are created. For leavers, HR confirms the final date before suspension, and an IT lead signs off on any data deletion.
- The line manager confirms the role template before accounts are created.
- HR confirms the final date before suspension.
- An IT lead signs off any data deletion.
05 rollout
From kickoff to live in 4 weeks
- Weeks 1–2Write role templates and connect HR, identity and device tools.
- Week 3Run for joiners with IT confirming each step.
- Week 4Add leavers and role changes.
06 after
What changes
New people can log in and start work on their first morning. Former staff lose access on time, every time, and the process runs the same way whether your office manager is in or on leave.
Assume 15 joiners and 15 leavers a month, at 90 minutes of IT work each, falling to 20 minutes of checking.
30 × 90 minutes = 45 hours a month today. 30 × 20 minutes = 10 hours. 35 hours a month saved.
What to measure
- New starters with working access on day one.
- Hours between leaving and access removal.
- Accounts with no owner.
- IT time per joiner and leaver.
07 evidence
What the research says
Third-party involvement in breaches doubled to 30%.
Verizon, 2025 Data Breach Investigations Report (opens in a new tab) · 2025
The global average cost of a data breach reached $4.99 million, a record high.
IBM, Cost of a Data Breach Report (opens in a new tab) · 2026
08 lessons
Mistakes to avoid
- Role templates that grant too much. Start from least access.
- Leavers handled by email. Drive it from the HR system.
- Forgetting shared accounts and apps outside single sign-on.
09 questions
Common questions
- Why does leaver access matter?
- Every account left open after someone leaves is one more way in for an attacker, and one more place client data can leak. IBM puts the global average cost of a data breach at $4.99 million.
- Does it handle laptops?
- It raises tasks in Jamf or Intune to ship, wipe or collect devices.