Offboard Developer Access
Remove a departing developer's sessions, grants, keys, and recovery routes across providers with dated verification receipts.
Offboarding is not one account disablement. A developer may have SSO sessions, personal access tokens, shared service keys, cloud roles, CI permissions, recovery factors, and local copies of credentials. A complete plan follows each authority path to its provider and verifies the result.
Start with the access register and current provider listings. Assign an operator for each system. Sequence actions so the team retains service continuity while removing personal access. OWASP's authorization and secrets guidance supports grant removal and credential lifecycle control, but exact revocation behavior is provider-specific.
Time-ordered checklist
| When | Action | Receipt |
|---|---|---|
| Before cutoff | Inventory human grants and owned service credentials | Provider IDs and owners |
| At cutoff | Disable identity and active sessions | IdP event and app session check |
| Immediately after | Revoke personal tokens and SSH keys | Provider status |
| Service handoff | Move owned automation to service identity | Healthy job run |
| Follow-up | Rotate shared credentials that person could copy | Old-key rejection |
| Close | Review backup access and recovery routes | Second-person signoff |
Do not assume an IdP disable event ends an application session immediately. Test the application's behavior. Do not rotate a shared production key without identifying all callers and a replacement health check. If a provider cannot revoke a token, record the limit and the earliest expiry.
Verification pass
Use a controlled test identity to rehearse the sequence. After disablement, attempt a harmless request through a still-open session and require denial under the agreed policy. Confirm a service job continues under its new identity. Check that a personal token no longer appears active at its issuing provider.
Keep the evidence ledger free of raw tokens and personal message content. Record the operator, time, system, decision, and provider receipt. A checklist box is not proof if the provider status is unknown. Leave unresolved systems on hold with an owner and date. For each copied credential, verify revocation at the issuing provider; disabling a user account alone is not proof.
Make offboarding verifiable
Use the offboarding checklist to identify owners, revoke grants and verify the result. Discuss a scoped review of your application's access controls.
Sources
- OWASP Authorization Cheat SheetAccessed
- OWASP Secrets Management Cheat SheetAccessed