The offboarding checklist engine: close every login before it can be used against you
When someone leaves, this starts a list of every account and key they had. Each task goes to a named person. The next day the system checks if it was actually done and alerts you if not.
A departure automatically starts a tracked checklist — and a second check the next day that it actually got followed
Setup: A weekend (~6-10 h)Running cost: $5-12/mo(software included)Time saved: none directly— closes the access-revocation gap the Beyond Identity numbers describe — this is not a weekly time saving, it is a breach-window savingAfter setup: You run it— you or whoever manages HR marks the departure and its last working day; the checklist, any wired revocation and the escalation after that run themselvesData lives: Your server— Employee records and the offboarding checklist stay on your own server; only the escalation alert text passes through Telegram or email, and only wired integrations receive a revoke call directly.
Jan explains what it does · about a minute
AI clone of Jan’s voice, generated locally with his consent.
Built for small businesses in general — not a sector list.
Paste it into your AI assistant — ChatGPT, Claude, Gemini, whichever you use. It first asks what tools you already have, then rebuilds this blueprint to fit them.
any AI platformno signupblueprint travels inside
Before you start
A documented list of every login your business uses per role — email, SaaS tools, shared drives, POS/till system, alarm code — you cannot revoke what you haven't listed
A machine that stays on around the clock for the checklist and escalation workflow — a mini PC, NAS or small VPS
One named person as the offboarding owner per departure, not a department — ChiefOnboarding assigns each task to a real person
A decided rule for involuntary departures: access closes before or during the exit conversation, not after — decide this before you need it
What breaks firstFAILS SILENTLY
a manual task gets ticked “done” without the account actually being closed — the checklist proves someone clicked complete, not that the login stopped working. For wired integrations, n8n's access-status check catches this. For manual tasks (the till, the van, the alarm code), spot-check two or three closed accounts a month.
Version history
v1.0 · 2026-08-04 — First release, built on ChiefOnboarding (AGPL-3.0) for the offboarding sequence, n8n for the next-day access-revocation check.
A departure automatically starts a tracked checklist for closing every account someone had — and a second, independent check the next day that it actually got followed, not just ticked.
The architecture
the same flow as text
[ Employee resigns / is let go / contract ends ]
▼
[ ChiefOnboarding (self-hosted, Docker) — the offboarding sequence ]
│ fires the moment their last working day is set
│ auto-revokes any wired integration (Google, Slack, GitHub…) via webhook
│ everything else becomes a task: POS login, van keys, alarm code, shared passwords
▼
[ n8n (self-hosted) — the next-day check ]
├─ re-reads every task and each integration's access status
└─ anything still open, on any account → one alert
Sent to Telegram or email. No silent gap between "the checklist says done" and the account actually being closed.
Two boxes, two different jobs. ChiefOnboarding owns the sequence — what needs closing, who owns each task, and firing the accounts it can reach directly. n8n owns the thing a checklist can never do for itself: come back the next day and check whether it actually happened.
Paste it into your AI assistant — ChatGPT, Claude, Gemini, whichever you use. It first asks what tools you already have, then rebuilds this blueprint to fit them.
any AI platformno signupblueprint travels inside
The problem
When someone leaves — quits, gets let go, or a contract just ends — closing every account they had is usually a mental checklist in one person's head, not a written one. Beyond Identity surveyed over 1,100 employees and business leaders across the US, UK and Ireland in 2022 and found 83% of departing staff admitted they still had access to at least one account from a previous job, and 56% said they'd used that access to harm their former employer on purpose — a number that rose to 70% among people who'd been fired. Their 2024 follow-up, focused specifically on layoffs, found close to a third of laid-off staff could still get into their old email (32%) or company software (31%), and almost a quarter (23%) could still see financial information. None of this needs a hacker. It just needs nobody to have actually clicked "remove" — and on a small team, that's usually exactly what happens, because there's no IT department whose whole job is to remember.
Tool choices — and why
ChiefOnboarding
(AGPL-3.0, 919 stars, active — commits through June 2026) is the engine, and it fits closer than the name suggests. Alongside onboarding, it ships a built-in Offboarding sequence (under People → Offboarding) that drip-feeds account-closure tasks the same way it drip-feeds welcome tasks to new hires. The genuinely useful part for this blueprint is its integration system: each connected service — Google Workspace, Slack, GitHub, or anything you wire up yourself through its webhook manifest format — reports back a real per-employee access status, rendered as a string like "Google (has access), Slack (no access)", and exposes a Revoke action that fires without anyone touching the vendor's own admin console. Wired services get closed automatically. Everything without an integration — a shared till login, a van's tracker app, the alarm code — becomes a task assigned to a named person with a due date, which is the honest ceiling of what any tool can do here. Nobody is shipping an API for your till.
n8n
(Sustainable Use License — free for internal business use, ~189k stars, releases most weeks) is the part that closes the actual gap the Beyond Identity numbers describe: not whether the checklist exists, but whether anyone checked it got followed. One scheduled workflow reads ChiefOnboarding's API the day after someone's last working day; anything still open — a task not ticked, or an access status still reading "has access" — becomes a single message instead of a report nobody opens. AI audit →
Alternative: Node-RED — older flow-based tool common in home automation; no built-in credential vault so you would add Bitwarden as a separate step
Monthly cost
Software: €0, both tools. AGPL only requires you to publish your changes if you modify ChiefOnboarding and re-host it as a product for other businesses — running it for your own team, unmodified, doesn't trigger that. Hosting: one small VPS at ~€5–12/month runs both containers comfortably for a team of any size this blueprint is built for.
Setup outline
Deploy ChiefOnboarding via Docker Compose on a small VPS or mini PC that stays on around the clock — Postgres plus the app container, HTTPS behind a reverse proxy.
Build the Offboarding sequence once: the checklist every departure needs regardless of role — disable email, revoke shared logins, collect keys and devices, remove from group chats, reassign anything they owned.
Wire the integrations you can, starting with whatever your team actually uses daily — Google Workspace or Microsoft 365 for email, Slack or Teams for chat — following ChiefOnboarding's webhook manifest docs. Each one you connect turns a manual task into an automatic one.
For everything without an integration, keep it on the checklist and name a real person as the owner. "IT" is not an owner; a name is.
Set every task's due date to the employee's actual last working day, not "sometime this week." For an involuntary departure, that due date is the start of the exit conversation, not the end of it.
Deploy n8n alongside it — or reuse an existing instance if you've already built another blueprint from this library — and create one workflow: daily trigger → call ChiefOnboarding's API for anyone in an active offboarding sequence past their last day → check task status and access status per integration → anything open → Telegram or email.
Run it once on a real departure before you trust it. Watch whether the escalation actually fires, not just whether the checklist looked complete on the screen.
Pitfalls — what goes wrong when you build this
A ticked box isn't a closed account
For wired integrations, n8n's check reads a real access status back from the service — that's a genuine verification. For manual tasks, it's still a human clicking "done." Spot-check two or three closed accounts a month the way you'd spot-check any control you actually rely on.
Involuntary departures need the order reversed
If someone's being let go, access has to close before or during the conversation, not after — the data above is worst specifically for firings, where 70% of those who kept access said they used it to cause harm. Have whoever runs IT ready to pull the trigger the moment the meeting starts.
Shared logins are the hole no per-employee sequence catches
A shared till password, a shared social media login, a shared account for the break-room streaming service — if it isn't tied to one person, no offboarding checklist will think to touch it on its own. Keep a short, separate list of shared credentials and rotate all of them on every departure, no exceptions.
AGPL is not "free to do anything with."
Self-hosting ChiefOnboarding for your own team, unmodified, is fine and unrestricted. Forking it, modifying it, and offering it as a hosted product to other businesses puts you inside the copyleft clause — read the license before you build a side business on top of it.
This doesn't replace the rest of offboarding
It closes the access gap. The exit interview, final pay, and any legal paperwork are still yours to run properly.
Verified repos
ChiefOnboarding — AGPL-3.0, 919 stars, active (commits through June 2026) n8n — Sustainable Use License (free self-hosted internal use), ~189k stars, active (pushed May 2026)
Get the next blueprint as it publishes — free, practical, verified tooling only.
