Revoke departing access
Remove or transfer physical, network, printing, application, and privileged access at the authorized time while preserving necessary records and continuity.
| Field | Value |
|---|---|
| Business area | access-network-printing |
| Primary role | it-security-administrator |
| Frequency | event-driven |
| Privacy sensitivity | high |
| Security sensitivity | high |
| Compliance review | needed |
Trigger and handoff
Trigger: An approved offboarding, role change, credential loss, or security action requires revocation.
Inputs
- Authorized scope and effective time
- Current access inventory
- Continuity and evidence requirements
Outputs
- Revoked credentials and sessions
- Confirmed residual-access review
- Escalated failures
Current manual methods
- Departmental checklist
- Badge collection
- Manual account search
Human judgment and approvals
-
Coordinate timing with safety
-
contract
-
and continuity context
-
Investigate unmatched identities or failed revocations
-
Approval: Authorized business owner confirms timing; security owner approves emergency revocation
Failure modes
- Hidden account or shared credential survives
- Disputed departure causes premature revocation
Success metrics
- Known access is removed at the authorized time
- Residual and shared access is explicitly reviewed