Best fit
A completed HR or identity-provider ticket can hide active SaaS accounts, old-role entitlements, expired exceptions, and revoked-access claims with no closeout evidence.
// Security & Compliance
Employee Exit & Role-Change Access Reconciler
Reconcile employee exits and role changes with IdP, SaaS, exception, and revocation evidence before an access closeout is accepted.
What problem does Employee Exit & Role-Change Access Reconciler solve?
A completed HR or identity-provider ticket can hide active SaaS accounts, old-role entitlements, expired exceptions, and revoked-access claims with no closeout evidence.
Use it to
- Audit a departure after the standard automation runs
- Check internal role changes for stale entitlements
- Track approved access exceptions to expiry
- Preserve revocation evidence for owner closeout
What it returns
- Event-to-access evidence ledger
- Orphaned and old-role access findings
- JSON owner-closeout gate
- IT and security review memo
A representative input and result
input One terminated employee still has an active non-SSO CRM account, while a revoked payroll account has no verified revocation receipt and an exception expired yesterday.
result Gate: BLOCK. Active access after exit, missing revocation evidence, non-SSO review, and an expired exception require owner closeout.
Access and approval boundaries
- Read access to one user-supplied local JSON evidence file.
- Write access only to the selected local output directory.
- No browser, network, credential, account, environment-variable, or external-action permission is required.
Known limitations
- The package reviews supplied exports and does not connect to or change an identity provider or SaaS account.
- It cannot prove that an export is complete, current, or authentic beyond the supplied evidence status.
- A ready result still requires the named IT or security owner to review the original systems and exceptions.
// choose with context
Is Employee Exit & Role-Change Access Reconciler the right skill?
It returns
Event-to-access evidence ledger. Orphaned and old-role access findings.
Do not use it as
The package reviews supplied exports and does not connect to or change an identity provider or SaaS account.
Compatibility, access, version, and licence
- Reads or accesses
- Declared local scope: access-review.json, access-review-output/**.
- Compatibility
- Documented normalized UTF-8 JSON input. Python 3.10 or newer on Windows, macOS, or Linux. Local files only; no live provider connection is required.
- Version
- 1.0.0
- Licence
- Review the package licence and seller terms at the linked destination.
Questions
Does it connect to a live account?
No. Version 1 reviews documented normalized local evidence only.
Does it take the external action?
No. It never submits, revokes, publishes, contacts, pays, or changes an external system.
What files does it create?
A findings CSV, evidence ledger CSV, summary JSON, and owner-review memo.
How does malformed input behave?
Missing identifiers, duplicate identifiers, bad timestamps, and invalid numbers fail before a ready result is produced.
Does a ready gate prove compliance or legal sufficiency?
No. It means the supplied records have no automated finding and are ready for the named owner or qualified reviewer.
Can the output be audited?
Yes. Every finding includes a stable code, record identifier, message, and source dataset.
Employee Exit & Role-Change Access Reconciler keeps proof and approval boundaries visible.
The listing includes the tested package, realistic samples, declared permissions, and known limitations.
Get Employee Exit & Role-Change Access Reconciler on Agensi