Developer Handover Pack

Developer Handover Pack

Employee Offboarding Automation

Handles all system access revocation the moment a departure is confirmed in BambooHR. Connects to Okta via the Users API to immediately suspend the employee's SSO session, revoking access to all downstream SaaS applications linked to Okta. Then calls the Google Workspace Admin SDK to disable the user account, set an automated out-of-office reply on the Gmail account, and transfer Google Drive ownership to the departing employee's line manager. All actions are logged to the automation platform's audit table. This agent produces a single structured confirmation payload that triggers the Task and Notification Agent. Complexity is Moderate because it spans two identity providers with different authentication models and requires a super-admin service account for Google Workspace.

// Input (from BambooHR webhook payload)
employee_id: string          // BambooHR internal employee ID
full_name: string            // employee display name
email: string                // work email address (primary identifier)
last_working_day: date       // ISO 8601 date, e.g. 2025-04-30
manager_email: string        // line manager email for Drive transfer
department: string           // used to scope Jira project template
employment_type: string      // 'employee' | 'contractor'

// Output (confirmation payload passed to Task and Notification Agent)
okta_suspended: boolean      // true if Okta account suspension confirmed
okta_user_id: string         // Okta user UID for audit log
google_disabled: boolean     // true if Workspace account disabled
google_drive_transferred: boolean  // true if Drive ownership moved
auto_reply_set: boolean      // true if Gmail out-of-office reply activated
revocation_timestamp: datetime     // UTC timestamp of completed revocation
error_flags: string[]        // list of any step-level errors encountered

Triggered by the confirmed output of the Access Revocation Agent. Creates a structured Jira offboarding project board from a saved template, populating subtasks for equipment return, exit interview scheduling, and any outstanding manual items. Each subtask is assigned to the correct owner using department and manager data from the BambooHR payload. Sends a structured payroll notification to Xero via the Xero Accounting API, including the final working day and leave balance pulled from BambooHR. Dispatches the exit survey to the employee's personal email address via Google Workspace on the penultimate working day. Posts a completion summary to the HR Slack channel once all automated steps are confirmed. Closes the BambooHR record to 'offboarded' status after the Jira equipment return task is marked complete by the manager. Complexity is Moderate due to the number of tool integrations and the conditional logic around equipment return gating the final record closure.

// Input (from Access Revocation Agent output payload)
employee_id: string
full_name: string
email: string                     // work email
personal_email: string            // for exit survey dispatch
last_working_day: date
manager_email: string
department: string
leave_balance_hours: number       // pulled from BambooHR Time Off API
okta_suspended: boolean
google_disabled: boolean
revocation_timestamp: datetime

// Output (per action, aggregated into Slack summary payload)
jira_board_url: string            // URL of the created Jira project
jira_equipment_task_id: string    // Jira issue key for equipment return subtask
xero_notification_sent: boolean   // true if payroll notification delivered
exit_survey_sent: boolean         // true if survey email dispatched
exit_survey_send_date: date       // penultimate working day date
slack_summary_posted: boolean
bamboohr_record_closed: boolean   // set after Jira equipment task completed
bamboohr_close_timestamp: datetime
error_flags: string[]

// On approval (equipment return gate)
// Manager marks jira_equipment_task_id as Done in Jira
// Jira webhook fires to the automation platform
// Agent calls BambooHR PATCH /v1/employees/{employee_id}
//   with status: 'offboarded' and offboard_date: today()

// ================================================================
// EMPLOYEE OFFBOARDING: END-TO-END DATA FLOW
// ================================================================

// TRIGGER
// BambooHR fires webhook on employee status change or last_working_day set
BambooHR.webhook.event = 'employeeStatusChanged' | 'lastWorkingDaySet'
payload.employee_id       -> string   // e.g. '4821'
payload.full_name         -> string   // e.g. 'Jane Smith'
payload.email             -> string   // e.g. 'jane.smith@yourcompany.com'
payload.personal_email    -> string   // e.g. 'jane.smith@gmail.com'
payload.last_working_day  -> date     // e.g. '2025-04-30'
payload.manager_email     -> string   // e.g. 'mark.jones@yourcompany.com'
payload.department        -> string   // e.g. 'Sales'
payload.employment_type   -> string   // e.g. 'employee'

// SUPPLEMENTAL FETCH (before agent 1 executes)
BambooHR.GET /v1/employees/{employee_id}/timeOff/calculator
  -> leave_balance_hours: number     // e.g. 24.5

// ================================================================
// AGENT HANDOFF 1: TRIGGER -> ACCESS REVOCATION AGENT
// ================================================================

// STEP 1: Suspend Okta SSO session
Okta.POST /api/v1/users/{okta_user_id}/lifecycle/suspend
  match by: email == Okta.profile.login
  -> okta_user_id: string            // e.g. '00u1abc2defGHIJK'
  -> okta_suspended: boolean         // true on HTTP 200

// STEP 2: Disable Google Workspace account
GoogleAdmin.PATCH /admin/directory/v1/users/{userKey}
  userKey: email
  body: { suspended: true }
  -> google_disabled: boolean        // true on HTTP 200

// STEP 3: Transfer Google Drive ownership to manager
GoogleAdmin.POST /drive/v3/files/{fileId}/permissions
  transferOwnership: true
  newOwner: manager_email
  -> google_drive_transferred: boolean

// STEP 4: Set Gmail auto-reply
Gmail.PUT /gmail/v1/users/{userId}/settings/vacation
  body: {
    enableAutoReply: true,
    responseSubject: 'Out of Office',
    responseBodyHtml: env.OFFBOARD_AUTO_REPLY_BODY
  }
  -> auto_reply_set: boolean

// STEP 5: Write revocation log entry
AuditLog.INSERT {
  employee_id, okta_user_id, okta_suspended,
  google_disabled, google_drive_transferred,
  auto_reply_set, revocation_timestamp: now()
}

// Access Revocation Agent output confirmation payload assembled
agent1.output = {
  employee_id, full_name, email, personal_email,
  last_working_day, manager_email, department,
  leave_balance_hours,
  okta_suspended, okta_user_id,
  google_disabled, google_drive_transferred, auto_reply_set,
  revocation_timestamp,
  error_flags: []
}

// ================================================================
// AGENT HANDOFF 2: ACCESS REVOCATION AGENT -> TASK & NOTIFICATION AGENT
// Condition: agent1.output.okta_suspended == true
//            AND agent1.output.google_disabled == true
// On failure: retry every 5 min up to 30 min, then Slack alert
// ================================================================

// STEP 6: Create Jira offboarding board from template
Jira.POST /rest/api/3/project
  templateKey: 'HR-OFFBOARD-TEMPLATE'
  projectName: 'Offboarding - {full_name} - {last_working_day}'
  -> jira_board_url: string
  -> jira_project_key: string        // e.g. 'OFF-142'

// STEP 7: Create equipment return subtask
Jira.POST /rest/api/3/issue
  projectKey: jira_project_key
  issuetype: 'Task'
  summary: 'Equipment return - {full_name}'
  assignee: manager_email
  dueDate: last_working_day
  -> jira_equipment_task_id: string  // e.g. 'OFF-142-3'

// STEP 8: Send payroll notification to Xero
Xero.POST /api.xro/2.0/ManualJournals  (Accounting) OR
Xero.POST /payroll.xro/1.0/Employees/{employeeId}/LeaveApplications (Payroll)
  body: {
    employee_id: xero_employee_id,   // matched by email
    final_working_day: last_working_day,
    leave_balance_hours: leave_balance_hours,
    notification_note: 'Offboarding triggered - final pay action required'
  }
  -> xero_notification_sent: boolean

// STEP 9: Dispatch exit survey email
// send_date = last_working_day - 1 business day (excl. env.JURISDICTION_HOLIDAY_CALENDAR)
Gmail.POST /gmail/v1/users/me/messages/send
  to: personal_email
  subject: 'We would love your feedback'
  body: env.EXIT_SURVEY_BODY_TEMPLATE
  scheduled_send_time: exit_survey_send_date
  -> exit_survey_sent: boolean
  -> exit_survey_send_date: date

// STEP 10: Post Slack summary to HR channel
Slack.POST env.SLACK_HR_WEBHOOK
  payload: {
    text: 'Offboarding complete for {full_name} ({last_working_day})',
    blocks: [
      { okta_suspended, google_disabled, xero_notification_sent,
        exit_survey_sent, jira_board_url },
      { pending: ['Equipment return (manager action in Jira)',
                  'Exit interview (HR action)'] }
    ]
  }
  -> slack_summary_posted: boolean

// ================================================================
// AGENT HANDOFF 3: EQUIPMENT RETURN GATE (human in loop)
// Manager marks jira_equipment_task_id Done in Jira
// Jira webhook fires to automation platform endpoint /webhooks/jira-equipment-done
// Condition: issue.key == jira_equipment_task_id AND status == 'Done'
// ================================================================

// STEP 11: Close BambooHR record
BambooHR.PATCH /v1/employees/{employee_id}
  body: {
    status: 'offboarded',
    offboard_date: today()           // ISO 8601
  }
  -> bamboohr_record_closed: boolean
  -> bamboohr_close_timestamp: datetime

// STEP 12: Write final audit log entry
AuditLog.UPDATE {
  employee_id,
  bamboohr_record_closed, bamboohr_close_timestamp,
  all_steps_complete: true
}

// ================================================================
// END OF FLOW
// ================================================================