Policy-first planning
Directory state, employee requests, and access policy remain separate inputs so decisions can be reviewed before any live integration or account change exists.
ENGINEERING PROJECT / PROJECT DETAILS
Employee Lifecycle Toolkit
ENGINEERING ARTIFACT / POWERSHELL
Lifecycle changes deserve a plan.
Make every action reviewable.
The Employee Lifecycle Toolkit converts a declared directory snapshot, employee requests, and access policy into an explainable onboarding, role-change, or offboarding plan with projected state and request-level audit records.
Guardrails by design
Approval gates, effective dates, identity consistency, protected accounts and groups, and managed-access scope are checked before actions are proposed.
Cross-platform tests
26 automated checks cover decisions, state preservation, repeat-run behavior, malformed input, and CLI output. GitHub Actions validates the suite on Ubuntu and Windows.
EXAMPLEInspect the lifecycle decisions
Fictional joiner, mover, leaver, scheduled, approval, and privileged-account cases
- Join: creates a projected disabled account, assigns the approved profile, and enables only after planned access is in place.
- Move: reconciles managed groups while preserving access outside the toolkit’s declared scope for separate review.
- Leave: plans disablement, session revocation, and managed-group removal while leaving retention, devices, applications, and ownership as explicit human follow-ups.
Source code, fictional policy and directory data, generated sample output, automated tests, and the CI workflow are available on GitHub.
Problem, implementation and evidence
Joiner, mover and leaver changes cross identity, access and ownership boundaries.
Keep requested changes, approval, actual effects and rollback evidence as separate records; idempotency matters when a workflow resumes.
What the evidence establishes
Source-linked automation project. This content release did not execute identity changes or validate a customer environment.
Reproduce or extend
Use a sandbox account and a bounded access matrix to test creation, modification, denial and cleanup before operational use.
Open the related experiment or review surface →