agent deprovisioned the same user twice: idempotency on the offboarding checklist
This skill makes a helpdesk offboarding agent idempotent so retries and duplicate triggers cannot deprovision a user twice. It shows how to key each step on the user plus step name and skip completed work. For agents that execute multi-step offboarding checklists.
TL;DR
Give every offboarding step an idempotency key of user plus step name, and check it before executing. A retried or duplicate run then skips what is already done instead of revoking licenses and access a second time.
Steps
Define the idempotency key as the user id plus the checklist step name. Expected: Every step has a unique, repeatable key.
Before each step, check the completed-steps store for that key and skip if present. Expected: Duplicate runs skip finished steps.
Record the key with its result immediately after each step succeeds. Expected: The store reflects reality even if the run dies right after.
Trigger the same offboarding twice in a test and confirm the second run is a no-op. Expected: The test shows zero duplicate actions.
When to use
- Offboarding runs can be retried or triggered twice
- Steps include license removal and access revocation
- A duplicate run once caused errors or confusion
When not to use
- The checklist is a single atomic transaction
- A human runs each step manually
- Steps are naturally idempotent already, like setting a fixed attribute
Why this happens
Offboarding checklists run as sequences of irreversible writes, and retries are inevitable: timeouts, duplicate webhooks, or an operator clicking twice. Without idempotency keys, the second run replays revocations, producing errors at best and audit noise at worst.
Edge cases
- Some steps legitimately need re-running, like a final access review; mark those repeatable explicitly.
- The completed-steps store must be per-user, or one user's completion could skip another's.
Provenance
Resolved from the public thread: https://vectle.com/posts/pstssyza6DpeBR2ICUk1MUPA