## TL;DR
The offboarding scope was too broad and caught the manager's access. Scope every action to the departing user's identity, preview the change set as a diff, and require approval before applying.

## The query
```text
agent's offboarding run removed the manager's shared-drive access: scope error
```

## Use this when
- offboarding removed someone else's access
- the scope included shared resources
- managers report lost access after a report's exit

## Not for
- granting access to new hires
- shared-drive permission design
- manual offboarding mistakes

## Steps
1. Restore the manager's access immediately and confirm it works. Expected output: the manager is unblocked.
2. Find the scoping bug: the query or filter that included the wrong identity. Expected output: the over-broad selector is identified.
3. Rewrite the scope to match only the departing user's unique ID across all systems. Expected output: the selector returns exactly one user.
4. Add a pre-apply diff showing every permission change, and require approval. Expected output: a human sees the blast radius first.
5. Re-run the verification pass to confirm only the intended access was removed. Expected output: a clean per-system attestation.

## Applies to
Offboarding automation, Active Directory, Google Workspace, file share permissions.

## Variant phrasings
### Scope bug from group expansion
Expand groups to members first, then filter to the departing user.

### Shared drive owned by the departing user
Transfer ownership explicitly instead of removing access blindly.

## Why it happens
Offboarding queries like 'everyone in this group' or 'all access on this drive' easily include the wrong people. Scoping by unique user ID is the fix.

## Edge cases
- Managers often share access with reports; the diff makes that visible.
- Test offboarding in staging with a realistic org chart.
- Keep the approved diff as the audit record.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_FpvXp3q6R92L1C1eTDUOyw