Joiner, mover and leaver access

Grants, adjusts and removes application access from one approved people record, so nothing survives a leaver.

macOS — coming soonSee the 4 automations
IT / AUTOMATE.md

Every Monday at 7am, list accounts with no sign-in for 45 days, then record the owner and last activity for the access queue.

Ready-made: Stale Account Sweep

The job, and what good looks like.

Access is granted by whoever remembers the request and removed whenever someone remembers to ask. New hires wait a week for the tools they need, leavers keep a mailbox and an admin group for weeks, and people who change role quietly keep the old role's permissions on top of the new ones. The workflow takes one approved people record as the source of truth. For a starter, it maps the role to a named access template, raises anything the template does not cover as a question for the manager, and schedules the grants for the first morning. For a mover, it lists what the old role had, what the new role needs, and the difference, so the extra is removed on purpose rather than by luck. For a leaver, it revokes the sign-in, the group memberships, the app grants and the shared mailboxes, then confirms each one closed rather than assuming it did. A human approves the template, the exceptions, and any access that has to wait until day two.

When it is handled

  • Starters working on day one
  • Leaver accounts closed on the last day
  • No orphaned app access after a role change

Works with tools like

  • Microsoft Entra ID
  • Okta
  • CyberArk
  • Jira Service Management

Ready-made automations. Pick the one that fits.

Each one is a plain-language document. Run it as it is, or change the timing, the rules and the tools to match your team.

Leaver Access Revocation

When a leaver record reaches its last day, block the sign-in, remove group and app grants in Entra ID and Okta, then confirm the closure in the offboarding channel.

When a leaver's last day passes

Mover Device Handover

When a role change is approved, wipe the old Jamf profile, enrol the device to the new owner, and note the handover in the IT channel.

When an employee changes role

Stale Account Sweep

Every Monday at 7am, list accounts with no sign-in for 45 days, then record the owner and last activity for the access queue.

Every Monday at 7:00am

Starter Account Setup

When a starter's access request is approved, apply that role's app bundle in Okta, and confirm to the manager what was granted and what was left out.

When a new starter reaches their start date

You stay in charge.
At every step.

It triages and sweeps. People approve every change.

  • No change without approval

    Blocking, revoking and purging wait for an analyst's OK.

  • Every run on the record

    What it read, what it did and what it is waiting on, kept for review and audit.

  • Scoped per automation

    Each automation gets only the access you grant it, and a local model can keep processing on your machine.

Stale Account Sweep

Approve before it updates the sheet?

ReviewApprove

Before you download.

Where does it run?
On your Mac or Windows computer, in the background. It keeps working after you close its window, and only reaches the folders and apps you connect for each automation.
How does it connect to our CRM and other tools?
Through each app's own connection where it offers one, signed in once by you, or by using the app in a browser the way you would. Each automation gets only the connections you give it, and the tools a page names are examples you can swap for your own.
Does it run when my computer is asleep?
It keeps your computer awake while a job runs and just before a scheduled one. While the computer is closed or off, nothing runs; when it wakes, it checks the inbox, calendar and other sources it watches for anything that arrived meanwhile.
How does my team use it?
Each person who runs automations installs the app. Keep a project in a shared folder, such as Google Drive or a network drive, and teammates can open it and follow every run, while one person owns it and runs it.
Do I need anyone technical to set it up?
No. Download the app, add an automation in plain words, and connect only what that job needs. Nothing runs until you switch it on.

Already have tools for this? Here is the difference.

Scripts and scheduled jobs

Precise, repeatable system tasks.

They break on the unexpected, and only their author can read or change them.

Security automation platforms

High-volume response playbooks in large teams.

They need a project to set up and an engineer to maintain each playbook.

AI chat assistants

Explaining an alert when you paste it in.

Nothing runs on schedule, and there is no scoped access or record of what was done.

AUTOMATE.md

Your routine, written in plain words. It runs on its own, follows your rules, handles the exceptions a flowchart can't, and asks you when it matters. The file stays yours, whichever AI model runs it.

Related workflows.

Access reviews

Works the periodic entitlement list so access nobody still needs is released, and every decision is written down.

Write your own

Privileged access review

Confirms every standing admin grant is still needed, and turns one-off elevation into a recorded, time-boxed grant.

4 automations

Audit trails

Joins the scattered administrative change records into one timeline, so an auditor's question is a search rather than a fortnight of exports.

Write your own

Start with one job.
Make it your own.

macOS — coming soon
  1. 1

    Get the app

    It runs on your computer, next to your files.

  2. 2

    Add the automation

    Paste the instructions into the app, or save them as a file next to your work.

  3. 3

    Try it, then turn it on

    Run it once and check the result. It only runs on its own once you switch it on.

macOS — coming soon