Employee Offboarding Automation Access revoked, equipment back, handover done
When someone leaves, every account is closed on time, the laptop comes back, and payroll and the manager have what they need.
- Installed for you · one-time$249
- Run for you$197/month
- Custom build · this process$2,000–3,500 one-time
- Starts whenHRIS event (termination recorded)
Usually bundled with onboarding at $397/month for both. Direct deprovisioning through the identity provider API is a custom add-on. Custom builds start at $2,000 site-wide; this band is for this process and its integrations.
Employee Offboarding Automation is an automation Agentmelt installs in your own tools. The free template is a file you import yourself; the kit ($49) adds the setup guide and prompts. Installed for you costs $249 one-time and is live within two working days of access, with a recorded walkthrough and 30 days of fixes. Run for you costs $197/month, with setup and maintenance included. A custom build of this process is $2,000–3,500 one-time; custom builds start at $2,000 site-wide. No call is needed for any option. Written by Max Zeshut; last revised 2026-09-18.
Reference stack: Claude + n8n. Node names are on each step; the file is under the template.
Founder at Agentmelt
Reviews every build before it goes live; the workflow escalates to a person, never past one.
What is employee offboarding?
Employee offboarding automation is the onboarding checklist run in reverse by a workflow instead of a spreadsheet: when the HR system marks a termination, it looks up every system the person was granted, opens one revocation ticket per system with a deadline on the last day (immediately for involuntary exits), schedules the equipment return, drafts the handover document for the manager, hands final pay to payroll and sends the exit survey — then checks daily that every ticket is closed and every asset is back, and escalates what is not. The point is not speed; it is that no account outlives the person who used it.
- People leave and their accounts stay active for weeks; we find out at the next audit.
- Offboarding is an email from HR to IT that says “please remove access for…” and a hope.
- Laptops come back late or never, because nobody owns the follow-up.
- The person who knew how the monthly report worked left, and the handover was a 20-minute call.
- Involuntary exits need access cut within the hour, and the process takes three days.
If two of these are yours, this is the process to look at first. Free audit — or read on.
What it looks like once it runs.
Offboarding automation makes the last day as controlled as the first. When the HRIS marks a termination, the workflow opens the access-revocation tickets with a deadline, schedules the equipment return, generates the exit checklist for the manager, sends the exit survey, and confirms every step closed — so no account survives the person who used it.
- 10:00 HR records a last working day. The list of every system this person can access is assembled from the identity provider.
- 10:01 One ticket per system, due at the agreed hour on the last day — immediately for an involuntary exit.
- 10:05 The return label goes out; the manager gets a draft handover document; payroll gets the final-pay task.
- Last day The exit survey is sent. Every evening after, anything still open is escalated to the IT lead.
Offboarding is usually a half-remembered checklist run under time pressure. Accounts stay active for weeks, laptops are never returned, the manager forgets the knowledge handover, and HR discovers the gaps in an audit. The security risk is real: former-employee access is one of the most common findings in SOC 2 and ISO 27001 reviews.
Every departure runs the same sequence with deadlines attached. IT has a single ticket per system with the exact revocation date and time, the manager has a knowledge-transfer template to fill before the last day, finance gets the final-pay and expense handoff, and HR can show an auditor a completed board for every leaver.
Trigger, then 8 steps.
All eight steps run without anyone; a person sees only what the guardrails escalate.
HRIS event (termination recorded)
Receive the termination record
Employee, role, last working day, reason category (voluntary/involuntary), manager and location. Involuntary departures take a fast path with same-day access revocation.
Assemble the leaver's access map
Queries the identity provider and the tracking board from onboarding for every system this person was granted, so nothing is guessed.
Open revocation tickets with deadlines
One ticket per system, due at the agreed time on the last day (or immediately for involuntary exits), assigned to IT with the account identifiers pre-filled.
Schedule equipment return
Sends the return instructions or courier label, records the asset tags, and adds a follow-up task if the equipment is not back within 7 days.
Generate the knowledge-transfer checklist
Drafts a handover document for the manager from the role description and recent project data (Jira, Notion, Drive): open items, recurring responsibilities, systems owned, people to introduce. The manager edits, not writes.
Hand off to finance and payroll
Creates the final-pay task with last day, accrued leave and pending expenses, and notifies payroll with a deadline that respects local rules.
Send the exit survey
Typeform or Google Form sent on the last day, results stored on the board and summarised quarterly by department.
Confirm closure
Daily run checks every revocation ticket is closed and every asset is back; escalates open items to the IT lead and HR after the deadline.
No step waits for a person.
What the workflow hands to someone, by rule:
- Closure is verified, not assumed: open tickets escalate until an IT lead closes them.
Every departure runs the same sequence with deadlines attached
Every departure runs the same sequence with deadlines attached.
No decisions needed. Anything the guardrails flag is handed to a person; the rest ran alone.
Each pattern page explains it in plain words and lists every automation that uses it.
The template is built on n8n (how the n8n AI Agent node works); the same steps run on Make, Zapier or plain code. The tool is chosen to fit your accounts, you own the result, and the template comes in all three formats.
A typical first month — a 350-person company preparing for SOC 2, four leavers a month, on BambooHR, Okta and Jira Service Management.
Not a client report
Offboarding is a half-remembered checklist run on the last afternoon. Accounts stay active for weeks — the last audit found three former employees still in the identity provider — laptops come back when someone remembers, and the manager never writes the handover. HR finds the gaps when the auditor asks.
The first month- Day 1BambooHR records the first end date. The workflow assembles the leaver's access map from the identity provider's groups and the onboarding board, and opens one revocation ticket per system with the exact date and time. Nothing is disabled by the workflow itself.
- Week 1IT works the tickets. The equipment-return label and instructions go to the leaver; the knowledge-transfer draft — open issues, recently edited pages, owned folders — goes to the manager, who spends ten minutes correcting it instead of an hour not writing it.
- Week 2Finance and payroll get the final-pay and expense hand-off. The exit survey lands on the leaver's last day without anyone remembering to send it.
- Week 3An involuntary exit: same-day revocation tickets, none of the welcome-style messaging, closure checked that evening. One ticket stays open and escalates until an IT lead closes it.
- Week 4The daily scan catches an end date set for next week with no ticket yet. HR opens the board for the month's four leavers: every step done and timestamped, shown to the auditor as it is.
| Metric | Before | After a month |
|---|---|---|
| Time to revoke all access | weeks, unverified | under 24 h; the same day for involuntary exits |
| Former employees still active at the next check | 3 | 0, and provable |
| Handover documents written | rarely | one per leaver, drafted for the manager to correct |
| Exit-survey response rate | 30–40% | 70% and above — it arrives on the right day |
Targets are the blueprint's own: mean time to revoke under 24 hours, equipment recovery at 14 days, the survey rate that follows from timing. Measure yours from the closure log — it is the same log the auditor reads.
This is a worked example, not a client's results: the company is a composite of a stated size, and the figures are the ranges this blueprint's own metrics make typical at that size. A real engagement replaces it, with permission, once an install has run a month.
Data it touches
- HRIS termination record
- Identity provider group membership (Okta, Entra ID, Google Workspace)
- Onboarding tracking board (what was granted)
- IT ticketing system
- Asset register (sheet or ITAM tool)
Guardrails
- The workflow requests revocation; IT executes it. Nothing is deleted automatically.
- Involuntary exits skip the welcome-style messaging and trigger same-day revocation tickets.
- The knowledge-transfer draft never includes compensation or performance data.
- Closure is verified, not assumed: open tickets escalate until an IT lead closes them.
Offboarding is a security control, not an HR courtesy
Auditors ask two questions about leavers: how quickly was access removed, and can you prove it? A workflow answers both. Every revocation is a ticket with a timestamp, and the daily closure check means an open account cannot quietly persist. Teams pursuing SOC 2 or ISO 27001 typically adopt this workflow before anything else in HR automation for that reason.
The access map step matters more than it looks. Most companies do not know every system a person was granted; the onboarding board from the onboarding workflow plus the identity provider's group list gives a complete inventory without a manual audit.
The knowledge-transfer draft
The one step that benefits from an AI agent is the handover document. Managers rarely write one because starting from a blank page takes an hour they do not have. The agent pulls the leaver's open Jira issues, recently edited Notion pages and owned Drive folders, and drafts a structured handover: what is in flight, what recurs, who depends on what. The manager spends ten minutes correcting it instead of an hour writing it — and the document exists, which it usually would not.
What to measure
Mean time to revoke: hours from last working day to all access removed (target: under 24 hours, zero for involuntary). Equipment recovery rate at 14 days. Exit-survey response rate, which jumps from the usual 30–40% to 70%+ simply because the survey arrives automatically on the right day.
What it connects to.
| Tool | Role in this workflow |
|---|---|
| n8n | Orchestration and deadline tracking |
| Okta / Entra ID / Google Workspace | Access map source |
| Jira Service Management / ServiceNow | Revocation tickets |
| Claude | Knowledge-transfer draft |
| Typeform / Google Forms | Exit survey |
Want this running without building it?
$197/month
We set it up in your tools, run it on our servershost it on our n8n cloud (or deploy it to your own n8n, Make or Zapier), watch it, and fix it when something changes. Setup included, cancel monthly; the automation stays yours if you leave.
$2,000–3,500 one-time
Your systems, your rules, your edge cases. A one-off build delivered into your accounts to keepon Claude and n8n, delivered into your accounts to keep, with documentation and a recorded walkthrough.
Usually bundled with onboarding at $397/month for both. Direct deprovisioning through the identity provider API is a custom add-on.
Also sold one-time, installed in your own accounts, as part of the hr teams package and the it administrators package and the hr managers package — do it yourself $49 · installed for you $249 · done for you $490.
When this becomes a custom build.
The subscription covers the standard version — $197/month, setup and maintenance included. Three things move it to a custom build ($2,000–3,500 one-time), delivered into your accounts to keep. If one of them is you, say so on the audit and the plan prices both.
Direct deprovisioning through the identity provider API rather than tickets to IT.
Several entities or regions with different retention and equipment-return rules.
Knowledge transfer that has to pull from project tools and produce a hand-over document automatically.
Running the standard version first is the usual path: the exceptions it logs in the first month are the scope of the custom build, with your own numbers. How custom builds work.
Frequently asked questions.
Can the workflow disable accounts directly?
By default it opens tickets and IT executes. If your IT team wants direct deprovisioning through Okta, Entra ID or Google Workspace APIs, that is a custom build with an approval step, so no account is disabled without a human confirming the record.
How does it handle involuntary terminations?
The reason category in the HRIS record selects a fast path: revocation tickets due immediately, no farewell messaging, manager notified privately, and HR reviews the board before anything is sent.
What if we do not have an asset register?
The workflow starts one — a sheet keyed by employee with serial numbers captured at onboarding. Offboarding then knows exactly what to collect.
Can an AI agent handle employee offboarding on its own?
The administrative part, yes: building the access list, opening and chasing the tickets, scheduling returns, drafting the handover from the person’s project tools. The decisions stay with people — the manager confirms the handover, IT closes each revocation, HR owns the conversation. The AI is used where words are needed, the handover draft and the summary of the exit survey; rules do the rest.
What should an employee offboarding checklist include?
Access (every SaaS tool, shared drives, code repositories, the identity provider), devices and badges, knowledge transfer (recurring tasks, open items, where things live), final pay and benefits, expense settlement, the exit interview or survey, and a confirmation that each item closed with a date. The workflow generates this list per person from the identity provider and the onboarding record rather than a template, so it includes the tools the person was actually given.
How is offboarding automation different from deprovisioning in the identity provider?
Deprovisioning cuts the accounts the identity provider knows about. Offboarding also covers what it does not: tools granted outside single sign-on, shared logins, equipment, knowledge and money. The workflow uses the identity provider as the source of the access map and adds the rest; direct deprovisioning through its interface is an option when the ticket route is too slow.
What this blueprint is built on.
Vendor documentation the steps rely on, and the rules the guardrails are written against.
- Okta — API reference developer.okta.com/docs/reference/
- Google — Workspace Admin SDK developers.google.com/workspace/admin
- Atlassian — Jira Service Management Cloud REST API developer.atlassian.com/cloud/jira/service-desk/rest/