identity-lifecycle-administration
Executes joiner, mover and leaver processes — provisioning, group membership, access changes on role change, and complete deprovisioning. Use this to set up or fix joiner-mover-leaver, deprovision someone completely, clean up accumulated access, audit group membership, or find accounts that outlived their owners.
git clone --depth 1 https://github.com/cbrock84/headcount /tmp/identity-lifecycle-administration && cp -r /tmp/identity-lifecycle-administration/plugins/it-operations/skills/identity-lifecycle-administration ~/.claude/skills/identity-lifecycle-administrationSKILL.md
# Identity lifecycle administration This is execution: creating, changing and removing access as people arrive, move and leave. **Policy — what a role should be entitled to, and least privilege — belongs to `security:access-and-identity`.** This skill runs the process that policy defines, and the gap between the two is where most access problems live. ## Joiners Provision from the role, not by copying a colleague. Copying is the single largest source of privilege accumulation: it inherits everything that person collected, including access they should not have had, and it propagates that indefinitely. Define role-based bundles for the common cases so a standard joiner is one action, and treat anything outside them as an exception requiring approval. Exceptions are fine; unrecorded exceptions are not. Time provisioning to be complete before the start date — coordinated through `people:onboarding-and-offboarding`. ## Movers are the neglected case Leavers get attention because someone is going. Movers do not, and so access accrues: the person who has worked in three departments has permissions from all three, and nobody ever removed the first two. Treat a role change as a **revoke and re-provision**, not an addition. This is the single highest- value fix available in most organizations, and it is almost always skipped because the person is still present and nothing appears broken. ## Leavers, completely Disable promptly at the agreed time, then work a checklist that reaches past the directory: systems outside single sign-on, local accounts, shared credentials the person knew, API keys and tokens they created, external services procured on a personal login, and any mail or calendar delegation. The gap is almost always the systems identity management does not reach. Maintain the list of them explicitly rather than discovering it during an audit. Preserve rather than delete where there is any prospect of investigation or legal hold — deletion is irreversible and occasionally very expensive. ## Recertify, and act on it Periodically, system owners confirm who should still have access. This is worth doing only if non-response defaults to removal; where non-response means retain, recertification becomes a formality that certifies whatever exists. Hunt specifically for orphaned accounts — accounts with no owner, service accounts nobody claims, and credentials that have not been used in months but still work. ## Tooling Directory and SSO: Microsoft Entra ID, Okta, Google Workspace, JumpCloud, and similar. HRIS as the trigger: Workday, BambooHR, Rippling, HiBob, Gusto, ADP, and similar. Identity should follow the HRIS record rather than a separate list of who works here. Provisioning runs on SCIM wherever the application supports it. Where it does not, the joiner-mover-leaver steps are manual and belong in a ticket template, not in someone's head. ## Never - Provision by copying an existing user. - Add access on a role change without removing the old. - Consider a leaver deprovisioned when the directory account is disabled. - Run recertification where non-response means retain.
Concentrates marketing and sales effort on a named set of accounts rather than on volume — qualifying whether the model fits your economics at all, building the account list and the buying group inside each, tiering effort against account value, coordinating so the account experiences one campaign rather than several, and measuring account progression instead of leads. Use this to decide whether to run an account-based program, build one, or work out why an existing one produces activity and no pipeline.
Designs orchestrator-and-subagent hierarchies for a repository — splitting agents by exclusive write surface, pairing every producer with an independent auditor, and enforcing the split with a script that runs in CI. Use this whenever the user wants to set up, expand, audit, or fix a multi-agent or subagent structure for a codebase; asks how to divide work between agents; wants agent charters, roles, or a surface map written; or is hitting agents that collide on the same files, review their own work, or drift from their remit. Also use when sizing a roster or deciding whether a new agent is justified.
Governs models and AI systems in production — intended use, evaluation, monitoring, human oversight, documentation, and the decision to deploy or retire. Use this before deploying a model or AI feature, when defining evaluation criteria, when a model's behavior has drifted, when assessing AI risk or regulatory exposure, or when deciding whether an AI system is fit for a consequential decision.
Produces executive-level research — market sizing, competitor mapping, trend analysis, and strategic intelligence — grounded in cited sources with the confidence in each claim made explicit. Use this to analyze a market or industry, map competitors, evaluate a market-entry or build-versus-buy decision, produce a research brief, or assemble evidence for a decision. Also use when comparing options that need a structured, evidence-based verdict rather than an opinion.
Optimizes for AI assistants and AI-generated answers — being retrievable, being cited, and being represented accurately when a model answers on your behalf. Use this when traffic is shifting from links to AI answers, when a brand is misrepresented or absent in AI responses, when planning content for retrieval rather than ranking, or when deciding how AI search changes an existing SEO program.
Improves visibility and conversion in the App Store and Google Play — metadata, keywords, screenshots, ratings, and the listing experience that turns an impression into an install. Use this to audit or optimize an app listing, plan a launch listing, diagnose poor install conversion, or improve store search visibility.
Protects and restores data — backup coverage and scope, retention, immutability against ransomware, and proving restores actually work. Use this to design a backup regime, verify restores, plan retention, protect backups from ransomware, or recover from data loss.
Runs the planning cycle — annual budget, rolling forecast, consolidation of business unit inputs, and the variance analysis that explains actuals against plan. Use this to build or challenge a budget, run a forecast cycle, consolidate departmental submissions, explain why results diverged from plan, or improve forecast accuracy.