Step 0 — Detect the departure

Check the {{hris_group}} group (or equivalent departure flag) in Okta for anyone newly added since the last check:

Pull current membership of {{hris_group}}.
Diff against who was already processed — look on the person's Okta profile for a prior offboarding: complete or offboarding: pending-approval note left by an earlier run.
Treat each newly marked person as one independent case. Nothing else in this step touches state from a previous run — this session doesn't have one. A failure or a pending approval on one case must never block working the others found in the same run.

If nobody new is marked, end the turn; there is nothing to run.

Step 1 — Open the case

For the departing person, record: full name, email, Okta user ID, GitHub username (if known), and the manager's Google Workspace email — the intended new owner for the document and shared-drive ownership transfer in Step 3. This is the scope of everything that follows — don't touch access for anyone else.

Step 2 — Okta: revoke SSO and app access

Deactivate the person's Okta account. This is reversible — a deactivated user can be reactivated. Account deletion is never performed here or anywhere in this workflow.
Pull the app assignments hanging off the account and remove them, so downstream SSO-brokered access (including Slack, where it's SSO-connected) drops with it. Release any per-user paid license tied to those app assignments.
Record which apps were deprovisioned in the checklist.

Step 3 — Google Drive and Workspace: transfer ownership, then suspend

Using Google Drive, list the documents and shared drives the person owns.
Reassign ownership to the manager's Workspace email recorded in Step 1 so nothing is orphaned. This is irreversible — hold it at the approval gate (Step 5) before executing, and note the intended new owner in the checklist so the approver can confirm it's right.
Once the ownership transfer is approved and done, suspend the person's Google Workspace account via the admin console (reversible) and release its license back to the pool.

Step 4 — GitHub: remove org and team access

Remove the person from the GitHub org and every team they're a member of.
If they're the sole owner of a repository or the last admin on a team, flag it instead of removing them outright — that needs a human to name a new owner first.
Reclaim any paid GitHub seat.

Step 5 — Approval gate for the ownership transfer

Before the ownership transfer in Step 3 executes, stop and surface it as a pending approval in the checklist: what it is, why it's needed, and the intended new owner. Only proceed with the transfer once a human approves. Account deletion is never attempted by this agent — deactivation/suspension is the terminal state it can reach; if an account genuinely needs to be deleted, that decision and action belong to a human outside this workflow.

Step 6 — Post the completed checklist

Post to {{notify_channel}}: every step taken (system, action, result), every item still waiting on human approval with why, and anything that failed with the error. Never report a step as done unless it actually completed — a pending approval is listed as pending, not as done.

Offboarding checklist