--- name: employee_offboarding description: "Offboard an employee cleanly: access revocation in the right order, knowledge transfer, equipment and accounts, final pay and COBRA deadlines, and a day by day timeline. Use when someone resigns, is terminated, is laid off, or retires, or when building or auditing an offboarding checklist." --- # Employee Offboarding ## Purpose Close out a departure so three things do not happen: the person keeps access after their last day, work only they understood goes dark, and pay or benefits deadlines get missed. This skill splits every departure into four tracks that run in parallel: access, knowledge, property and money, and people. It handles voluntary resignations, terminations for cause, layoffs, and retirements, and it changes the timing, not the checklist, when a departure turns hostile. The control anchor is NIST SP 800-53 Rev. 5 PS-4, Personnel Termination: disable system access within a defined period, revoke authenticators and credentials, run an exit interview that covers security topics, retrieve organizational property, retain access to information the person formerly controlled, and notify the people who need to know. Final pay and COBRA timing come from state law and the US Department of Labor. ## Workflow 1. Classify the departure before touching anything. Record the type (resignation, termination for cause, layoff or reduction, retirement, contract end, job abandonment or death in service), the last working day, the last day of employment if they differ, the notice given, and the risk tier. Use the risk tier to set speed: - Tier 1, hostile or for cause: revocation happens at or before the termination conversation, in one block, with Legal and HR present in the plan. - Tier 2, involuntary but not hostile, such as a layoff: revocation at the end of the last working day, privileged access pulled earlier that day. - Tier 3, voluntary and cooperative: phased revocation across the notice period, with high risk access still pulled on the last working day, never after. 2. Open one offboarding record and name one owner. Create a single checklist with an owner, a due time, and an evidence field for every line. Notify HR, payroll, IT or security, facilities, the direct manager, and finance on the same day the departure is confirmed. A departure known to one team and not the others is the most common cause of missed revocation and missed pay deadlines. 3. Run knowledge transfer during the notice period, not on the last day. Follow `references/knowledge-transfer-plan.md`. Inventory active projects, recurring duties, approvals only this person can give, key internal and external contacts, and single points of failure. Assign an interim or permanent owner to each item, schedule live walkthrough sessions, transfer ownership of files, tickets, calendars, and workflows, and have the manager sign off that each critical item has a named owner. If the departure is immediate, skip to a recovery pass: mine email, docs, tickets, and code history for the same inventory, and mark every gap as an open risk instead of pretending the transfer happened. 4. Revoke access in order. Follow `references/revocation-order.md` exactly. The short version: identity provider and email first because email resets almost everything else, then active sessions and tokens, then privileged and production access, then SaaS apps that sit outside single sign-on, then shared passwords the person knew, then physical access, badges, and VPN. Disable, do not delete, on day one. Deletion destroys the audit trail and the mailbox you may need for handover or legal hold. Verify revocation by trying to list the person in each system after the change and by checking that sessions are gone, because disabling an identity provider account does not end existing browser sessions or refresh tokens on its own. 5. Recover property and close accounts tied to things. Collect laptops, phones, tablets, hardware keys, badges, keys, cards, and vehicles against the asset register, and get a signed return receipt. For remote staff, send a prepaid return label the same day and record the tracking number. Remote wipe only company data on personal devices enrolled for that purpose. Never hold final pay hostage for unreturned property: many states bar deductions without written authorization, and the safe route is to pay on time and pursue property separately in writing. See `references/final-pay-and-cobra.md`. 6. Run the money and benefits track against real deadlines. Use `scripts/offboarding_plan.py` to build the dated timeline, then verify the state final pay deadline with the state labor agency before payroll commits to a date. Process final wages, accrued paid time off where state law or policy requires it, commissions and bonuses under the plan terms, expense reimbursements, and retirement account notices. For health coverage, state the exact end date for each plan in writing. For COBRA, meet the federal clock in `references/final-pay-and-cobra.md`: employer notifies the plan administrator within 30 days, the administrator sends the election notice within 14 days after that, the person gets at least 60 days to elect, and the first payment is due within 45 days after election. Check for a state mini-COBRA rule when the employer has fewer than 20 employees. 7. Handle the people track with care. Agree the announcement wording and timing with HR and the departing person where the situation allows it. Tell the team what changes for them, who owns what now, and nothing about private reasons for leaving. Introduce successors to key clients and vendors before the last day when the departure is cooperative. Run an exit interview with a neutral interviewer, not the direct manager, covering the reason for leaving, the manager relationship, tools and workload, and the security reminders in PS-4: confidentiality duties that survive departure, return of information, and any post-employment restrictions that actually apply. Record themes, not verbatim quotes, and route them to someone who can act. 8. Close and audit at day 7 and day 30. At day 7, confirm final pay landed, property is back or in tracked transit, COBRA notices went out, and no system still lists the person as active. At day 30, re-check dormant access: group memberships, distribution lists, shared drives, third party tools billed per seat, on-call rotations, code ownership, and approval chains. Archive the completed checklist with its evidence. That record is what an auditor, or a manager six months later, will ask for. ## Output Contract Deliver a complete offboarding packet for the named person, containing: - A header with departure type, risk tier, last working day, last day of employment, offboarding owner, and the owners for HR, IT or security, payroll, and the manager track. - A dated day by day timeline from confirmation to day 30, generated or checked with `scripts/offboarding_plan.py`, with the state final pay deadline and the COBRA dates shown as real calendar dates. - A revocation checklist in the order in `references/revocation-order.md`, each line with owner, due time, status, and evidence. - A knowledge transfer plan with an owner for every project, duty, approval, and key contact, plus a list of unresolved single points of failure. - A property return list matched to the asset register, with return method and tracking where relevant. - A final pay and benefits sheet: amounts or calculation inputs, pay date, coverage end dates per plan, and COBRA notice dates. - An exit interview summary and the day 7 and day 30 audit sign-offs. ## Operating Rules - Revoke in order, verify after. A checklist that says done with no evidence is not done. Evidence means a system screenshot, an audit log line, a ticket id, or a second person confirming the account no longer appears. - Disable first, delete later. Keep the mailbox and account in a disabled state until Legal clears deletion and handover is complete. Put a legal hold in place before any deletion when litigation, an investigation, or a records request is plausible. - Shared secrets are compromised secrets. Any shared password, API key, or service account secret the person knew gets rotated, even on friendly departures. Individual credentials get revoked, shared ones get changed. - Pay on time even when other tracks slip. Final pay deadlines carry penalties in many states and goodwill everywhere. Property disputes, missing paperwork, and slow handovers do not move the pay date. - Never state a state pay deadline or a benefits rule from memory in the packet. Verify it for that state and that plan, and cite the source and date checked in the packet. - Keep reasons private. The packet records the departure type because timing depends on it. It does not record gossip, health detail, or performance narrative beyond what HR needs for the file. - Contractors and vendors count. End dates on statements of work trigger the same revocation, property, and knowledge steps. Orphaned vendor accounts are a common audit finding. - If quality and speed conflict on a hostile exit, speed on revocation wins and documentation catches up within 24 hours, with the gap noted honestly in the record.