Running an offboarding

For: an admin, likely in HR or IT/security. Takes about 6 minutes.

What this does

Starting an offboarding tells Stacktic someone is leaving. Stacktic builds a plan of every tool tied to that person. It finds those tools from their department and from their actual access. Then it sends a task for each tool to whoever owns it.

Removing the access is still a human job. The owner does it in the real tool and confirms it here. Stacktic tracks who's done it. Once everyone has, it produces the paper trail.

Starting a run

From /offboarding, click "Start an offboarding." Then step through three screens:

1. Pick the person leaving. Search by name, email, or department.
2. Confirm their department. Stacktic uses it to pull in every tool tagged to that department and its parent departments. So the plan isn't limited to tools it's seen them log into.
3. Preview the plan. You see every tool it found, grouped by owner. Each tool has a note on why it's on the list: department, observed access, or both. Uncheck anything you don't want included before you start.

From the preview, you can Start now or Schedule for later. If you schedule, pick a future date and time, and the run starts on its own then. That's useful when a departure is announced ahead of the actual last day.

Letting sponsors offboard their own contractors

A contractor's sponsor is the person inside the company who's accountable for them. The sponsor is usually the first to know the contractor's engagement has ended.

To let sponsors start the offboarding themselves, turn on Allow sponsors to offboard contractors under Settings → General → Permissions. It's off until you turn it on.

With it on, a sponsor sees Offboard… in the ⋮ menu for each current contractor they sponsor. That counts whether they sponsor the contractor directly or sponsor the contractor's agency. The menu is in two places:

• on the contractor's profile;
• on each row of the agency's Contractors tab.

A sponsor confirms the department, previews the plan, and can start now or schedule for later, the same as anyone else. The same checks apply. Tool owners get their checklists the same way.

A sponsor can only start a run. They can't open it, cancel it, or run a silent offboarding. So after starting, they go back to the contractor's profile with a confirmation. Your admins follow the run from /offboarding as usual.

Checking whether someone is ready first

Not sure someone is ready to be offboarded? Open their profile and choose Offboarding check from the ⋮ menu. It tells you straight away whether they're good to go. If they aren't, it lists what to sort out first.

It can't start anything, so it's safe to look. Anyone with a Stacktic login can use it, including people who can't start an offboarding themselves.

The check looks for:

• Tools they're the primary owner of. Every tool needs an accountable owner. So these tools have to be handed to someone else before an offboarding can start. Each tool comes with a link to reassign it.
• Contractors and agencies they sponsor. Every contractor and agency needs someone inside the company accountable for them. So each one needs a new sponsor before an offboarding can start. Each comes with a link to its profile, where you change the sponsor. Changing an agency's sponsor covers all of its contractors at once.
• Integrations that run on their credential. Removing their access would break the connection. So reassign it to someone else first.
• A missing root department. If your organization doesn't have one yet, nobody can be offboarded until an admin sets it up on the Departments page.

It also flags two things that won't stop an offboarding but are worth knowing:

• Tools where they're the operational contact. Tasks go to the primary owner instead, but the tool loses its day-to-day contact.
• A missing department. Stacktic can only pick up the tools it has seen them use.

It also tells you if the person is already being offboarded. Only one offboarding can be under way for someone at a time.

The check isn't available for shared accounts or for people who've already left.

The same things stop a run from starting wherever you start it, on the web or in Slack. They apply when you schedule one, too.

Stacktic checks when you schedule, and again when the time comes. Something may have come up since, such as the person taking over a tool. If so, Stacktic waits an hour and tries once more. If it's still in the way, the run stops and you get an email. Sort out what the email names, then run it from the Scheduled list.

What happens after you start it

Each tool's owner gets a Slack DM. It's a checklist of exactly what to remove access to, with one row per tool. Every row has two buttons:

• Done, for once they've removed the access;
• Mark exception, for when they can't remove it or it doesn't need removing.

Either way, they leave it noted. The DM updates live as owners work through it. So you can watch the run close out from the offboarding page.

Most rows are manual. The owner reads the row, removes the access in the actual tool, then clicks Done.

A smaller set of connected tools can do more. For these, the integration supports removing access automatically, and that's turned on for the connection. Their row also offers "⚡ Remove via Stacktic." The owner can start the removal right from the DM instead of doing it by hand. Outside of that, Stacktic doesn't touch access on its own.

The compliance report

Once every task on the run is closed, Stacktic generates a compliance report for that person's offboarding. (A closed task is either removed or an accepted exception.) The report lists:

• every tool involved;
• who removed what, and when;
• any exceptions, with their reasons.

You can print it or download it as a PDF. It stays attached to that run for the record.