IT playbook · AI Employee: Ivy

Contractor Access Expiration

Zero orphaned contractor accounts post-end date

Install this playbookBack to marketplace
The problem

Contractors get access on day one and keep it until somebody remembers. The engagement ends in June; the Okta account, the GitHub org membership, the AWS role, the Notion workspace all stay live into September because nobody owns the deprovisioning. Auditors find it, security finds it, occasionally an ex-contractor accidentally reveals they still have access. Expiration dates go into HRIS at hire; the enforcement never happens.

At a glance
Trigger
Cron (daily) + HRIS event
Approvals
Manager confirms extension before revoke if flagged
What it does
Writes to your systems
Systems
Okta · SaaS licence catalogue · MDM
How it feels in production

An hour-by-hour walkthrough.

Every day at 06:00, Ivy scans HRIS for contractors whose engagement end date is within the next 14 days, plus any whose end date has already passed but who still hold active access anywhere. For each, Ivy inventories current access: Okta apps, GitHub orgs, AWS roles, Google Workspace, Slack, Notion, Jira, third-party SaaS. Builds a plan: - 14 days out: notify the sponsoring manager with the access inventory and a one-click "extend" or "confirm end date" option. Extensions require a business justification and route to manager-of-manager if beyond 90 days. - 7 days out: reminder to manager if no decision, cc to the security-oncall channel. - 1 day before: final notice; if no extension, the deprovision plan is queued to execute at 23:59 on the end date. - On the end date: Ivy suspends Okta (which cascades SSO to most apps), revokes GitHub org membership, removes AWS role bindings, transfers file ownership per company policy, and files the access-revocation record. - 7 days after: Ivy checks every SaaS not on SSO for residual access; anything found gets revoked manually via API and flagged for the runbook. Manager sees the outcome. Security sees the weekly digest. Auditor sees the record. Nobody has an unmonitored contractor account past its end date.
How it works

Step by step.

  1. 01

    Poll HRIS + external-worker directory daily

    Read every contractor / vendor / consultant record with engagement end date within 14 days. Include already-expired records still holding active access anywhere as a safety net.

    Workday · Rippling · BambooHR · Vendor management system
  2. 02

    Inventory every access surface per contractor

    Okta apps + roles, GitHub org membership, AWS IAM bindings, Google Workspace, Slack, Notion, Jira, third-party SaaS on the entitlement map. Cross-check identity plane vs. individual apps for drift.

    Okta · GitHub · AWS · Google · Slack · SaaS registry
  3. 03

    Notify manager with extend-or-confirm decision

    14 days out: DM the sponsoring manager with the inventory and a one-click choice. Extensions require justification + capped at 90 days without escalation; confirm end-date queues the deprovision.

    Slack · Teams · Web UI · Approval flow
  4. 04

    Execute the deprovision at end-of-day

    On end date at 23:59 local: Okta suspend (cascades SSO), GitHub org remove, AWS role unbind, Google account suspend with file-ownership transfer per policy, Slack deactivate. Verify each write.

    Okta · GitHub · AWS · Google · Slack · Backup service
  5. 05

    Post-deprovision sweep + record

    7 days after end date, sweep every non-SSO SaaS for residual access — some vendors don't propagate SSO revocation cleanly. File full access-revocation record with per-system status for audit + weekly security digest.

    SaaS registry · Audit log · Security digest
Systems and wiring

What you connect to make this run.

Workday · Rippling · Vendor management

read

Contractor engagement dates + sponsoring manager + business justification. Some companies keep contractors in a separate vendor-management tool from employees — Ivy reads both, unified.

Okta · Google Workspace · Microsoft Entra

read+write

Identity plane. Suspend the account and let SSO cascade. Read app-level assignments to verify the cascade reached every downstream service.

GitHub · AWS IAM · Jira · Notion · Slack

read+write

Direct API calls per surface. GitHub org membership + repo collaborator, AWS role bindings + long-lived access keys, Jira org roles, Notion guest access, Slack channel + workspace membership.

Backup service · File transfer

write

For Google Workspace + Notion + Dropbox, contractor-owned files are transferred to the sponsoring manager per policy before account deletion. Captured in the revocation record.

What changes

Before and after, honestly.

Contractors with active access past engagement end
Before
15-40% (drift for weeks)
After
Under 1% (auto-execute on the day)
Time from engagement end to full revocation
Before
10-60 days
After
Under 4 hours
Audit findings on ex-contractor access
Before
5-25 per audit cycle
After
Zero at steady state
IT hours per contractor offboarding
Before
1-3 hours (manual per-system revoke)
After
Under 10 minutes (manager decision only)
Related

Playbooks that pair with this one.

HR

Employee Offboarding

Same deprovision mechanism for employees; contractor flow is the same skeleton with different data sources.

Security

User Access Reviews (UAR)

Quarterly review catches whatever slipped past this daily flow.

IT

License Reclamation

Reclaimed licenses from expired contractors feed the pool this playbook manages.

Frequently asked

Answers about this playbook.

What if the contractor's end date isn't known at hire time?

HRIS gets a default (30 or 90 days per policy). If the engagement is open-ended, the sponsoring manager confirms every 90 days via the same nudge flow. No open-ended access without regular reconfirmation.

How does it handle contractors converting to employees?

HR marks the conversion in HRIS; Ivy cancels the pending deprovision and transitions the account to employee-standard entitlements. Access-history record is preserved for audit continuity.

What about contractors with break-glass access to production?

Elevated access requires per-request JIT (see security/just-in-time-jit-access), not standing access. If a contractor holds standing prod access, Ivy flags it in the weekly security digest as a control-gap regardless of engagement dates.

Can managers auto-extend without escalation?

Up to 90 days from the current end date. Beyond that requires manager-of-manager sign-off plus a written justification; policy prevents indefinite extensions by inattention.

What if a SaaS vendor doesn't support API-based revocation?

Ivy files a manual-revoke ticket to the SaaS owner with the specific action needed and tracks acknowledgement. Never claims coverage of a system it can't verify — the audit record shows manual steps explicitly.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore IT playbooks