Lifecycle
Dated operations are managed as scheduled windows, not loose tasks. The internal sweep runs every minute, in the server's timezone. Once scheduled, the whole journey is automatic:
Window types
| Window | Use | On open | On close |
|---|---|---|---|
| Activation | Effective-date hire | Activates the user, provisions and sends the welcome | — |
| Suspension | Vacation, medical leave | Suspends and disables accounts | Restores the previous status |
| Deactivation | Offboarding | Deactivates and disables accounts | — |
Key rules:
- The reason is derived from the type (hire ⇒ onboarding, offboarding ⇒ termination); only suspension chooses among vacation / medical leave / other.
- No overlapping windows for the same user.
- A manual block placed during a suspension is never overwritten by the automatic return.
- The return re-enables only accounts backed by a current access grant (least privilege); manual exceptions are exempt.
- Default deactivation time: 23:59 of the given day.
Welcome (onboarding)
On the effective hire, the user receives an email with their username, the provisioned systems and an expiring first-access link — never the password. If the profile has a manager, they get an informational copy without credentials.