Five stages. One signed decision. No orphaned sessions.
Every identity change — joiner, mover, or leaver — routes through the same deterministic pipeline. The parse step is the only place a language model touches the decision; everything downstream is structured data, OPA policy, signed packets, and tamper-evident logs.
The failure modes of manual offboarding.
Manual offboarding can cross several admin consoles and handoffs. When evidence lives in separate checklists, access and licence status can be difficult to verify after departure.
Model the licences and operator time that apply to your environment.
Manual offboarding requires coordination across people and admin consoles.
Disconnected checklists can leave accounts or licences active after departure.
The workflow records decisions, approvals, credential leases, and execution evidence.
The five stages, in order.
Gatekeeper
Natural-language intake from Slack, Teams, a webhook, or an HR ticket. Gemini distills the raw text into a structured IntentPacket with a confidence score. Adversarial inputs (prompt injection, schema hijack) are caught by a deterministic post-filter before the packet enters the rest of the pipeline.
Metadata
Parallel lookups against HRIS (BambooHR and Workday today; Rippling on the roadmap), your asset system, and every connected portal. Three questions answered: is this person really terminated, what do they still own, and does the HRIS agree with the requester?
Risk
Signals combine into a deterministic, explainable score: privileged account, production ownership, HRIS disagreement, recency, dollar value. Above 0.75 it routes to HITL; above 0.95 it blocks. Every component of the score is in the audit log.
Policy (OPA)
Open Policy Agent evaluates every decision against your tenant's Rego. Allowed actions are then signed with a per-tenant HMAC-SHA256 key so the executor never runs an unsigned packet. The signing key lives in Vault; the doer fetches it just-in-time per execution. (Asymmetric Ed25519 signing — so a compromised doer cannot forge — is on the near-term roadmap.)
Doer Agent
Fetches a 60-second JIT credential from Vault, calls each portal's API in parallel, and writes a SHA-256-chained event to the Zero-Trust WORM ledger for every action. Soft phase (deactivate + revoke sessions) is immediate; hard phase (delete) defers 5 minutes so reinstate-on-mistake works.
What the executor actually receives.
Each downstream call is driven by a single signed packet. Here's the shape:
{
"intent_id": "01J9F2W3Q5R7T9V1X3Y5Z7B9",
"intent_type": "offboard",
"target_identity": {
"email": "john.doe@acme.com",
"hris_id": "bh-4471",
"department": "Sales",
"privileged": false,
"prod_owner": false
},
"actions": [
{"system": "okta", "verb": "deactivate"},
{"system": "m365", "verb": "block_signin"},
{"system": "github", "verb": "remove_from_org"},
{"system": "slack", "verb": "deactivate"},
{"system": "zoom", "verb": "delete"},
{"system": "salesforce", "verb": "freeze_with_grace_30d"}
],
"risk_score": 0.41,
"opa_decision": "allow",
"issued_at": "2026-05-17T03:14:24Z",
"signature": "hmac-sha256:7f2ac91ed604b3e1...",
"tenant_id": "acme-prod"
}The OPA Rego Policy Evaluation.
Before any execution signature is minted, Open Policy Agent evaluates the packet against your tenant's Rego policy. Language models never make authorization decisions:
package iam.authz
default allow = false
default require_hitl = false
# Route to Human-in-the-Loop if risk score exceeds threshold or user is privileged
require_hitl {
input.risk_score > 0.75
}
require_hitl {
input.target_identity.privileged == true
}
require_hitl {
input.target_identity.prod_owner == true
}
# Allow automated execution only when HRIS confirms termination and no HITL triggered
allow {
not require_hitl
input.intent_type == "offboard"
input.metadata.hris_confirmed == true
}The ExecutionStep Receipt Contract.
Each individual portal mutation logs a structured receipt into the Zero-Trust WORM audit chain:
{
"step_id": "step_01J9F2W4K2M8N1P3Q5R7S9T2",
"intent_id": "01J9F2W3Q5R7T9V1X3Y5Z7B9",
"target_system": "okta",
"action_verb": "deactivate",
"status": "success",
"latency_ms": 412,
"vault_lease_id": "auth/approle/lease/h83j2...",
"vault_lease_ttl": 60,
"parent_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"event_hash": "9a1bd3fa8c12ef07a932bc61e38a4b27f6c91ed604b3e105a8dc92f8b5493012",
"timestamp": "2026-05-17T03:14:25.412Z"
}Looking for microservice topology and Vault details?
Inspect the 6-service decoupled architecture, Kafka partition schema, HashiCorp Vault 60s JIT leasing lifecycle, and WORM ledger verification algorithm.
See it run on your stack.
A 20-minute screen-share. We point a sandboxed tenant at your test directory. You watch a real offboarding go from Slack message to six portals revoked in under fifteen seconds — or we stop early and you have nothing to evaluate.
Or read the technical architecture first.