HR & RECRUITING
Revoke provisioned access when a hire no-shows or the offer is rescinded
When an onboarding record is marked Rescinded or No-Show, removes the accounts and access that were granted during provisioning and posts a deprovisioning summary for security…
How it runs
The automated pipeline, trigger to output.
- TriggerOnboarding marked Rescinded / No-Showmonday.com
- LogicRead provisioning log for granted access
- ActionRemove user from GitHub orgGitHub
- ActionRevoke SaaS + mailbox invitesmonday.com
- OutputPost deprovisioning audit summarySlack
What it does
When a hire's onboarding is canceled, this workflow walks the access that was already provisioned — GitHub org membership, SaaS invites, mailbox — and revokes each one, then files an auditable record of what was removed so dangling credentials never linger.
When to use it
Use it when offers occasionally fall through after provisioning has started, leaving orphaned accounts. It closes the security gap by tying deprovisioning to the same record that drove provisioning.
How it works
- 1**Trigger** — An onboarding item moves to Rescinded or No-Show status on the Monday board.
- 2**Logic** — Read the provisioning log to determine exactly which accounts and grants were created for this hire.
- 3**Action** — Remove the user from the GitHub organization and any teams they were added to.
- 4**Action** — Revoke or disable the SaaS and mailbox invites recorded during provisioning.
- 5**Output** — Post a deprovisioning summary to the security Slack channel for the audit trail.
Set it up
What you configure once, before turning it on.
- 1Connect monday.comVisual work management for teams.
- 2Connect GitHubRepos, issues, pull requests, actions.
- 3Connect SlackChannels, DMs, threads, mentions.
- 4Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 5Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 6Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More HR & Recruiting workflows
Assemble and send the debrief packet after the final interview
Triggered when a candidate's final interview ends on the calendar, it waits a short window for scorecards, compiles the aggregated packet to Google Drive.
New-Hire Credential Intake to Renewal Calendar Holds
When a new credential is added to the tracker, it validates the record, files the document.
Credential Renewal Evidence Verification Agent
When an employee replies with a renewed credential document, an agent reads the attachment, extracts the new expiry date and credential number.
Escalate Compliance-Blocking Credential Lapses to Managers
Each day it finds credentials that have already expired or expire within 48 hours and are flagged compliance-blocking.
Day-one readiness orchestrator across all onboarding owners
An agent-driven coordinator that, when a hire is launched, plans the full provisioning program across IT, Facilities, and Finance, opens the work in your tracker.
Loom intake to req-tracker row in Airtable
Transcribes a hiring manager's Loom intake, scores the brief for completeness, and either logs a ready req in Airtable or routes incomplete intakes to a follow-up Slack ping.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.