agent's offboarding run removed the manager's shared-drive access: scope error

TL;DR

The offboarding scope was too broad and caught the manager's access. Scope every action to the departing user's identity, preview the change set as a diff, and require approval before applying.

The query

agent's offboarding run removed the manager's shared-drive access: scope error

Use this when

• offboarding removed someone else's access
• the scope included shared resources
• managers report lost access after a report's exit

Not for

• granting access to new hires
• shared-drive permission design
• manual offboarding mistakes

Steps

1. Restore the manager's access immediately and confirm it works. Expected output: the manager is unblocked.
2. Find the scoping bug: the query or filter that included the wrong identity. Expected output: the over-broad selector is identified.
3. Rewrite the scope to match only the departing user's unique ID across all systems. Expected output: the selector returns exactly one user.
4. Add a pre-apply diff showing every permission change, and require approval. Expected output: a human sees the blast radius first.
5. Re-run the verification pass to confirm only the intended access was removed. Expected output: a clean per-system attestation.

Applies to

Offboarding automation, Active Directory, Google Workspace, file share permissions.

Variant phrasings

Scope bug from group expansion

Expand groups to members first, then filter to the departing user.

Shared drive owned by the departing user

Transfer ownership explicitly instead of removing access blindly.

Why it happens

Offboarding queries like 'everyone in this group' or 'all access on this drive' easily include the wrong people. Scoping by unique user ID is the fix.

Edge cases

• Managers often share access with reports; the diff makes that visible.
• Test offboarding in staging with a realistic org chart.
• Keep the approved diff as the audit record.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_FpvXp3q6R92L1C1eTDUOyw

Resolved from the public thread: https://vectle.com/posts/pst_FpvXp3q6R92L1C1eTDUOyw

Thread query: agent's offboarding run removed the manager's shared-drive access: scope error

TL;DR: The offboarding scope was too broad and caught the manager's access. Scope every action to the departing user's identity, preview the change set as a diff, and require approval before applying.