Notifications
Clear all
Topic starter
01/08/2026 9:00 pm
TL;DR: Employee offboarding now fails when workflows, OAuth grants, API keys, and shared automations keep acting after the human has left, according to Unixi. Traditional HR-IT offboarding is incomplete because the real authority often sits in non-human identities that survive the departure event.
NHIMG editorial — based on content published by Unixi: workflow-aware offboarding and the non-human identities left behind after employee departure
By the numbers:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: How should teams offboard workflows that outlive the employee who created them?
A: Treat the workflow as the thing being offboarded, not just the user.
Q: Why do standard offboarding processes miss non-human identities?
A: Because most offboarding controls are built around human accounts, devices, and SaaS seats.
Q: What breaks when a departed employee's automation still has valid access?
A: Account disablement no longer equals access removal.
Practitioner guidance
- Create a workflow inventory at offboarding time Record every automation the employee created, approved, or inherited, along with owner, business purpose, data scope, credential type, and last review date.
- Revoke delegated grants before closing the leaver ticket Check OAuth grants, personal access tokens, service accounts, shared inbox rules, webhook secrets, and low-code connectors before the employee's identity is fully closed.
- Transfer or retire automations explicitly Move each workflow to a named business owner or retire it, then reissue credentials under managed workload identities instead of leaving personal tokens in place.
What's in the full article
Unixi's full article covers the operational detail this post intentionally leaves for the source:
- The full workflow-aware offboarding model for inventories, ownership mapping, and approval chains
- Specific examples of how HR, IT, and security should trigger automation reviews after role change or departure
- The article's discussion of how shared inboxes, connectors, and service accounts should be reauthorised or retired
- The closing recommendations for audit routing, alerting, and post-change monitoring of stale workflow activity
👉 Read Unixi's analysis of workflow-aware offboarding and zombie agents →
Workflow offboarding and shadow automations: what teams are missing?
Explore further
01/08/2026 9:07 pm
Offboarding must now be treated as a workflow lifecycle control, not a user lifecycle checkbox. The article shows that a departed employee can lose their account while the automation they built still operates through valid non-human credentials. That breaks the old assumption that disabling the person disables the authority. For IAM and IGA teams, the practitioner conclusion is clear: workflow ownership and credential ownership must be governed as first-class lifecycle objects.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- A second finding from the same research shows that 91.6% of secrets remain valid five days after the targeted organisation is notified, which explains why lifecycle delays remain operationally dangerous.
A question worth separating out:
Q: Who is accountable when a former employee still has access after offboarding?
A: Accountability usually sits with IAM, IT, and application owners together, because offboarding failure is a cross-system governance issue. Directory admins may disable the account, but SaaS owners must also invalidate sessions and remove app access. Frameworks such as the NIST Cybersecurity Framework 2.0 support that shared control ownership.
👉 Read our full editorial: Workflow-aware offboarding is now an NHI governance problem
