Employee Offboarding & Access Revocation
An employee leaves. Done well, offboarding means revoking access immediately, reassigning open work, and settling final pay — in the right order, so nothing is missed and nothing happens too early.
The Goal
What you'd actually type to Dendr AI
Natural-language input
“Offboard consultant Mark Reyes, effective today; he was staffed on Project Atlas and Project Helix.”
The Ecosystem
Agents & MCP servers orchestrated
HR / HRIS
Workday
Illustrative vendor
Processes the termination and final-pay record.
IT provisioning
ServiceNow
Illustrative vendor
Revokes system access and reclaims hardware.
Resourcing
Salesforce (PSA)
Illustrative vendor
Reassigns open client engagements and closes timesheets.
E-signature
Adobe Sign
Illustrative vendor
Sends any required exit documentation.
Payment
Payroll / expense rails
MCP server
Processes final pay and any outstanding expense reimbursement.
Collaboration
Slack
Illustrative vendor
Removes the employee from team and client channels.
Communication
Graph / SMTP MCP
Notifies engagement managers and affected clients' internal contacts.
How It Works
How the Dynamic Planner builds the chain
The Intent Engine structures the goal above into an intent graph. The Dynamic Planner grounds each step against the live Agent Capability Graph and assembles the coordination path at request time — no one pre-authored this exact sequence.
Process the termination in Workday, including final-pay calculation.
Immediately revoke all system access and flag hardware for return via ServiceNow — triggered off the Workday termination event, not a separate manual request.
Reassign open client engagements (Project Atlas, Project Helix) to other staff in Salesforce PSA and close out timesheets.
Send any required exit documentation via Adobe Sign.
Process final pay and outstanding expense reimbursement through the payment agent.
Remove the employee from Slack team and client channels.
Email engagement managers with the reassignment plan and notify affected client contacts as appropriate.
Semantic Routing in Action
The right agent, every time
access.revoke.all is grounded to ServiceNow and explicitly triggered by the Workday termination event — the planner treats HR as the source of truth for who's still employed, not IT's own ticket queue.
project.staffing.reassign matches Salesforce PSA specifically, distinct from a general CRM contact update, via the professional-services domain tag.
payroll.final.process is grounded to the payroll-capable payment agent, filtered away from the general AR/AP payment agents used in other use cases through capability-tag domain separation.
Approve Once. Use Anytime.
Chain-level authorization, reused on every run
- People Ops and IT security jointly approve the “standard offboarding” chain once — covering termination, revocation, reassignment, final pay, and communications, tagged
hr.offboarding.standard. - Every future offboarding runs under that same standing authorization, with the departing employee and their active engagements substituted in — revocation never waits on a separate request.
- An involuntary-termination variant, with stricter revocation timing, is modeled as its own separately approved pattern rather than a conditional branch — so the two can be governed and audited independently.
Dynamic Replanning & Resilience
What happens when reality doesn't match the happy path
Access revocation is deliberately sequenced to fire the moment the Workday termination event lands, ahead of reassignment and communications — a safety property that holds even if downstream steps are delayed or fail.
If a client engagement can't be immediately reassigned (no available staff), the planner still closes the departing employee's access on schedule and flags the unresolved engagement separately.
Business Outcome
What the firm gets
Access is revoked immediately and consistently, regardless of how many systems the employee touched.
No dropped client engagements — reassignment is a structural step, not something an engagement manager has to remember.
A complete, auditable offboarding record for every departure, useful for HR compliance and client-facing continuity.
Related
The matched pairs
See how professional services firms offboard securely with Dendr AI.
Get a demo and see the offboarding chain run against your own registered agents.
Workday, ServiceNow, Salesforce, Adobe Sign, and Slack are referenced above as illustrative, recognizable examples of the enterprise systems Dendr AI can orchestrate through A2A, MCP, vendor adapters, or OpenAPI manifests. These are reference architectures, not case studies of named customers, and do not imply a partnership, integration certification, or endorsement by those vendors.