Employee Lifecycle Agent
Finds the access that outlived the job
- 8hard rules
- Things it must never do, enforced in every run
- 5handover rules
- Conditions where it stops and gives the work to a person
- 10output fields
- A structured result, not a paragraph you have to re-read
- ≤7steps per run
- Bounded work: at most 6 tool calls, enforced by the runtime
Read-only by design. This agent has no path to sending, spending, publishing or committing anything. Where that limit is the product, removing it would remove the reason to trust the output.
Overview
Joining works because someone is waiting for a laptop and complains. Leaving fails quietly: the person has gone, nobody is inconvenienced by their still-active account, and it surfaces in an access review a year later or in an incident.
The middle case is worse. Someone changes role and gains the new team's access without losing the old team's, and after three internal moves one person can approve a purchase order, raise the invoice and release the payment. That is the textbook segregation-of-duties failure, and an organisation doing nothing wrong builds it one promotion at a time.
This agent reconciles the employment record against what people can actually reach. It reports access that outlived a leaver, access a mover kept from a previous role, joiners still waiting on something their role needs, and the combinations that let one person complete a transaction end to end. It also finds what left with someone — the process only they knew, the account only they could access.
It revokes nothing. Removing someone's access is an action with employment and operational consequences, and it belongs to a person who can see the context this agent cannot.
Benefits
Access reviews stop being a scramble
The findings are already known and already being fixed.
The dangerous combination found early
Before it is used, deliberately or by accident.
Leavers actually leave
Including the systems nobody remembered they were on.
What it does
Finds access that outlived the job
Leavers still holding accounts. It fails silently because nobody is inconvenienced by it.
Catches accumulated access from moves
The new team's permissions added, the old team's never removed. Three promotions and one person can run a transaction end to end.
Names the dangerous combinations
Approve, raise and release held by one person — the finding auditors look for first.
Finds the joiner still waiting
Someone in post for three weeks without something their role requires, which nobody logged.
Reports what left with a person
The process only they ran and the account only they could reach — found while it can still be recovered.
Revokes nothing
Removing access has employment and operational consequences. It belongs to a person who can see what this cannot.
What this changes
What this changes about your week
- It takes over
- Reconciling who works here against what they can still reach, across every system.
- Done today by
- IT and HR separately, neither holding both halves.
- How often
- Quarterly in theory. In practice, the week before an audit.
- Typical manual effort
- Days of exporting access lists and matching them to a staff list by hand.
Why People and hiring in particular. Identity tools track accounts, HR systems track employment, and almost nobody reconciles the two. Every finding lives in that gap — including the person who, after two internal moves, can raise a purchase order, approve it and release the payment.
Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
Employee Lifecycle Agent has no path to sending, spending or committing. That limit is why its output is safe to act on.
How it runs
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
- 1InputValidated against the agent input schema
- 2Modelclaude-opus-5 with automatic fallback
- 3Toolssearch_knowledge, extract_structured_data
- 4PermissionsRuns READ actions automatically; anything higher waits for approval
- 5OutputStructured result matching the output schema
- 6LoggingTokens, duration and every step recorded
Demo
Demo dataIllustrative sample output, abridged.
Input
{
"access": [],
"people": [],
"asAtDate": "2026-09-02"
}Output
{
"escalate": true,
"disclaimer": "A reconciliation of records. No access has been changed, nobody has been assessed, and holding access beyond a role is a process finding rather than an allegation about any person.",
"policyFound": true,
"joinersWaiting": [
"EMP-231 has been in post 23 days without the ticketing access their role requires. Nothing in the record shows it was ever requested."
],
"escalationReason": "A leaver has held production database access for 214 days, and one person can complete a purchase transaction end to end.",
"accumulatedAccess": [
{
"person": "EMP-091",
"system": "Purchase approvals",
"fromRole": "Procurement Officer — a role they left in March. The access came with the role and never went with it."
}
],
"leaversWithAccess": [
{
"person": "EMP-118",
"system": "Production database",
"sensitivity": "high",
"daysSinceLeaving": 214
},
{
"person": "EMP-204",
"system": "Payment gateway",
"sensitivity": "high",
"daysSinceLeaving": 61
}
],
"singlePersonAccess": [
"The payroll bureau portal is reachable by one person, who is a leaver at the end of this month."
],
"unattributedAccess": [
"A service account with production write access, granted 2023, matching no person or role on record."
],
"dangerousCombinations": [
{
"person": "EMP-091",
"systems": [
"Purchase approvals",
"Supplier ledger",
"Payment release"
],
"combination": "Can raise a purchase order, approve it, and release the payment. Three roles' access held by one person after two internal moves."
}
]
}Requirements
Integrations
No integrations required.
Before you start
- Your people and their current roles, including joiners, movers and leavers
- What each system's access is granted by
- A knowledge base holding your access policy and role definitions
- Requires the All-Access plan or higher
Use cases
After a leaver
Everything still open in their name, in one list.
Quarterly access review
What an auditor would raise, before they raise it.
After a reorganisation
Where moves left people holding two roles' worth of access.
Before an audit or certification
The segregation findings, found by you first.
Pricing
All-Access
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits
FAQ
Does it remove access?
No, and it must not. Revoking someone's access mid-project or mid-dispute has consequences this agent cannot see. It produces the list; a person acts on it.
How is this different from an identity tool?
Identity tools track accounts and HR systems track employment. Almost nobody reconciles the two, and every finding lives in the gap between them. That reconciliation is the whole product.
Does it assess people?
Never. It reports access against roles. Holding access you no longer need is a process failure, not a personal one, and the report says so.
Reviews
Reviews open once customers have run this agent.
Need this agent to work differently?
Tell us what to change and our team will scope a customised version for your business.
Customize this agent