RXed AI News

The offboarding checklist engine: close every login before it can be used against you

A departure automatically starts a tracked checklist — and a second check the next day that it actually got followed

A departure automatically starts a tracked checklist for closing every account someone had — and a second, independent check the next day that it actually got followed, not just ticked.

The problem

When someone leaves — quits, gets let go, or a contract just ends — closing every account they had is usually a mental checklist in one person's head, not a written one. Beyond Identity surveyed over 1,100 employees and business leaders across the US, UK and Ireland in 2022 and found 83% of departing staff admitted they still had access to at least one account from a previous job, and 56% said they'd used that access to harm their former employer on purpose — a number that rose to 70% among people who'd been fired. Their 2024 follow-up, focused specifically on layoffs, found close to a third of laid-off staff could still get into their old email (32%) or company software (31%), and almost a quarter (23%) could still see financial information. None of this needs a hacker. It just needs nobody to have actually clicked "remove" — and on a small team, that's usually exactly what happens, because there's no IT department whose whole job is to remember.

The architecture

Two boxes, two different jobs. ChiefOnboarding owns the sequence — what needs closing, who owns each task, and firing the accounts it can reach directly. n8n owns the thing a checklist can never do for itself: come back the next day and check whether it actually happened.

Tool choices — and why

ChiefOnboarding (AGPL-3.0, 919 stars, active — commits through June 2026) is the engine, and it fits closer than the name suggests. Alongside onboarding, it ships a built-in Offboarding sequence (under People → Offboarding) that drip-feeds account-closure tasks the same way it drip-feeds welcome tasks to new hires. The genuinely useful part for this blueprint is its integration system: each connected service — Google Workspace, Slack, GitHub, or anything you wire up yourself through its webhook manifest format — reports back a real per-employee access status, rendered as a string like "Google (has access), Slack (no access)", and exposes a Revoke action that fires without anyone touching the vendor's own admin console. Wired services get closed automatically. Everything without an integration — a shared till login, a van's tracker app, the alarm code — becomes a task assigned to a named person with a due date, which is the honest ceiling of what any tool can do here. Nobody is shipping an API for your till.

n8n (Sustainable Use License — free for internal business use, ~189k stars, releases most weeks) is the part that closes the actual gap the Beyond Identity numbers describe: not whether the checklist exists, but whether anyone checked it got followed. One scheduled workflow reads ChiefOnboarding's API the day after someone's last working day; anything still open — a task not ticked, or an access status still reading "has access" — becomes a single message instead of a report nobody opens.

Monthly cost. Software: €0, both tools. AGPL only requires you to publish your changes if you modify ChiefOnboarding and re-host it as a product for other businesses — running it for your own team, unmodified, doesn't trigger that. Hosting: one small VPS at ~€5–12/month runs both containers comfortably for a team of any size this blueprint is built for.

Setup outline

1. Deploy ChiefOnboarding via Docker Compose on a small VPS or mini PC that stays on around the clock — Postgres plus the app container, HTTPS behind a reverse proxy.
2. Build the Offboarding sequence once: the checklist every departure needs regardless of role — disable email, revoke shared logins, collect keys and devices, remove from group chats, reassign anything they owned.
3. Wire the integrations you can, starting with whatever your team actually uses daily — Google Workspace or Microsoft 365 for email, Slack or Teams for chat — following ChiefOnboarding's webhook manifest docs. Each one you connect turns a manual task into an automatic one.
4. For everything without an integration, keep it on the checklist and name a real person as the owner. "IT" is not an owner; a name is.
5. Set every task's due date to the employee's actual last working day, not "sometime this week." For an involuntary departure, that due date is the start of the exit conversation, not the end of it.
6. Deploy n8n alongside it — or reuse an existing instance if you've already built another blueprint from this library — and create one workflow: daily trigger → call ChiefOnboarding's API for anyone in an active offboarding sequence past their last day → check task status and access status per integration → anything open → Telegram or email.
7. Run it once on a real departure before you trust it. Watch whether the escalation actually fires, not just whether the checklist looked complete on the screen.

Pitfalls — the real ones

A ticked box isn't a closed account. For wired integrations, n8n's check reads a real access status back from the service — that's a genuine verification. For manual tasks, it's still a human clicking "done." Spot-check two or three closed accounts a month the way you'd spot-check any control you actually rely on.
Involuntary departures need the order reversed. If someone's being let go, access has to close before or during the conversation, not after — the data above is worst specifically for firings, where 70% of those who kept access said they used it to cause harm. Have whoever runs IT ready to pull the trigger the moment the meeting starts.
Shared logins are the hole no per-employee sequence catches. A shared till password, a shared social media login, a shared account for the break-room streaming service — if it isn't tied to one person, no offboarding checklist will think to touch it on its own. Keep a short, separate list of shared credentials and rotate all of them on every departure, no exceptions.
AGPL is not "free to do anything with." Self-hosting ChiefOnboarding for your own team, unmodified, is fine and unrestricted. Forking it, modifying it, and offering it as a hosted product to other businesses puts you inside the copyleft clause — read the license before you build a side business on top of it.
This doesn't replace the rest of offboarding. It closes the access gap. The exit interview, final pay, and any legal paperwork are still yours to run properly.

Verified repos

ChiefOnboarding — AGPL-3.0, 919 stars, active (commits through June 2026)
n8n — Sustainable Use License (free self-hosted internal use), ~189k stars, active (pushed May 2026)