HR & RECRUITING
Departure-Triggered Access Mirror and Deprovision
When an employee is marked as departing, it reverses their original provisioning checklist into revoke tasks, assigns them to the same owners, and confirms deprovisioning in Slack.
How it runs
The automated pipeline, trigger to output.
- TriggerEmployee marked departing (HRIS webhook)HTTP webhook
- ActionLoad original provisioning itemsPostgres
- LogicInvert grants into revoke tasks with due dates
- ActionCreate revoke tasks for original ownersAsana
- OutputPost deprovisioning summary to security + HRSlack
What it does
Uses the provisioning record you built at hire time as the authoritative list of what to take back at departure. It generates one revoke task per granted item, routes each to the same owning team, and tracks completion so nothing stays granted after someone leaves.
When to use it
Use it when offboarding is risky and inconsistent — orphaned accounts, unreturned laptops, lingering door access — and you want deprovisioning to be the exact mirror of what was originally granted.
How it works
- 1A webhook fires from your HRIS when an employee is marked as departing, carrying their employee ID and last day.
- 2The flow loads that person's original provisioning items from Postgres.
- 3A logic step inverts each grant into a revoke action and computes a due date tied to the last working day.
- 4It creates an Asana revoke task per item assigned to the original owning team.
- 5A deprovisioning summary is posted to the security and HR Slack channel, listing every access being pulled and its owner.
Set it up
What you configure once, before turning it on.
- 1Connect HTTP webhookTrigger any URL on agent actions.
- 2Connect PostgresAny Postgres URL — query, write, migrate.
- 3Connect AsanaTasks, projects, milestones — everywhere.
- 4Connect SlackChannels, DMs, threads, mentions.
- 5Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 6Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 7Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More HR & Recruiting workflows
Assemble and send the debrief packet after the final interview
Triggered when a candidate's final interview ends on the calendar, it waits a short window for scorecards, compiles the aggregated packet to Google Drive.
New-Hire Credential Intake to Renewal Calendar Holds
When a new credential is added to the tracker, it validates the record, files the document.
Credential Renewal Evidence Verification Agent
When an employee replies with a renewed credential document, an agent reads the attachment, extracts the new expiry date and credential number.
Escalate Compliance-Blocking Credential Lapses to Managers
Each day it finds credentials that have already expired or expire within 48 hours and are flagged compliance-blocking.
Day-one readiness orchestrator across all onboarding owners
An agent-driven coordinator that, when a hire is launched, plans the full provisioning program across IT, Facilities, and Finance, opens the work in your tracker.
Loom intake to req-tracker row in Airtable
Transcribes a hiring manager's Loom intake, scores the brief for completeness, and either logs a ready req in Airtable or routes incomplete intakes to a follow-up Slack ping.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.