#joiners and leavers

##Why a checklist

Onboarding is annoying when it goes wrong. Offboarding is dangerous. The gap between someone's last day and their last working login is where most small-company security incidents live, and it is almost always an oversight rather than a decision.

The checklist is generated from what the workspace already knows: the accounts that exist, the licences assigned, the devices issued, the shared drives granted. It is specific to the person, not a generic template somebody has to adapt.

##The joiner checklist

Raise a joiner from the dashboard or by replying to the request that arrived in the inbox - "new starter on the 6th, sales" is classified as an account ticket and offers to create the checklist.

That licence warning is the point of generating the list from inventory. A new starter with no mailbox on their first morning is a bad morning, and the checklist saw it coming eleven days out.

##Role templates

A template says what a role normally gets. Create one per role you hire into more than once, and the checklist starts pre-filled.

groups        sales, all-staff
licences      Microsoft 365 Business, CRM seat
device        laptop · standard build · dock if office-based
drives        sales-shared (read/write), company-wide (read)
software      browser, CRM client, VPN
# excluded deliberately
not granted   finance drive, admin console, server access

# a template is a starting point. Anything unusual about the
# individual still gets added by hand, and that is recorded.

Templates are also where least privilege actually gets enforced in a small company. The decision about whether sales needs the finance drive is easier to make once, calmly, than each time somebody joins in a hurry.

##The leaver checklist

The leaver list is built from reality rather than the template: what this person actually holds, right now, according to the inventory.

##Why the order matters

Revocation runs before notification. If the sequence is reversed, the window between "your access is being removed" and the access actually being removed is a real window, and people have used it.

1. Sessions first. Disabling an account does not end a session that is already open. Revoke tokens, then disable.
2. Then second factors. A left-behind authenticator is a re-entry route if the account is ever re-enabled.
3. Then data access. Shared drives, mailbox rights, anything delegated.
4. Then hardware and licences. Collect the kit, reclaim the seats - the money part, which also happens to be the easiest to forget.

A rushed leaver - a dismissal, a walkout - can run the first three steps immediately as a single approval, with the hardware and licence steps left open for the following week.

###Contractors and temporary access

A joiner can be given an end date at creation. The leaver checklist is then generated automatically on that date, which means contractor access expires on schedule rather than whenever somebody remembers the project ended.

##What you can prove afterwards

A closed leaver checklist is the artefact an insurer, a client security questionnaire or an auditor is actually asking for: who did what, when, approved by whom, and what the system looked like either side.

It exports as a single PDF or JSON record per person. Service providers can generate these per client, which turns a monthly compliance question into a file.

##Limits