agent's offboarding run removed the manager's shared-drive access: scope error
Fixes a helpdesk agent's offboarding run that removed a manager's shared-drive access: scoping actions to the departing user and diff preview. Use when offboarding hits the wrong accounts or resources. Not for access-request workflows.
TL;DR
The offboarding scope was too broad and caught the manager's access. Scope every action to the departing user's identity, preview the change set as a diff, and require approval before applying.
The query
agent's offboarding run removed the manager's shared-drive access: scope errorUse this when
- offboarding removed someone else's access
- the scope included shared resources
- managers report lost access after a report's exit
Not for
- granting access to new hires
- shared-drive permission design
- manual offboarding mistakes
Steps
- Restore the manager's access immediately and confirm it works. Expected output: the manager is unblocked.
- Find the scoping bug: the query or filter that included the wrong identity. Expected output: the over-broad selector is identified.
- Rewrite the scope to match only the departing user's unique ID across all systems. Expected output: the selector returns exactly one user.
- Add a pre-apply diff showing every permission change, and require approval. Expected output: a human sees the blast radius first.
- Re-run the verification pass to confirm only the intended access was removed. Expected output: a clean per-system attestation.
Applies to
Offboarding automation, Active Directory, Google Workspace, file share permissions.
Variant phrasings
Scope bug from group expansion
Expand groups to members first, then filter to the departing user.
Shared drive owned by the departing user
Transfer ownership explicitly instead of removing access blindly.
Why it happens
Offboarding queries like 'everyone in this group' or 'all access on this drive' easily include the wrong people. Scoping by unique user ID is the fix.
Edge cases
- Managers often share access with reports; the diff makes that visible.
- Test offboarding in staging with a realistic org chart.
- Keep the approved diff as the audit record.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_FpvXp3q6R92L1C1eTDUOyw