← Use cases/Example · People and IT

Joiners and leavers.
The right access, first hour to last.

An example of what a people and IT team builds and runs on Xema. When someone joins, an agent sets up every account they need — and only the access their role calls for — while a person approves anything sensitive. When they leave, every access is revoked on their last day. Every grant is approved and audited, so nobody starts late and nobody keeps more than they should.

access on day onerevoked on the last dayevery grant approved and audited
  1. 01Create the identity
  2. 02Grant each system by role
  3. 03Approve sensitive access · a person decides
  4. 04Record every grant
  5. 05Revoke on the last day
Business outcome

Access is ready on day one, sized to the role, and everything is closed on the last day.

What Xema provides
  • An agent that sets up and closes out access
  • Manager approval for the sensitive systems
  • A record of what was given, who approved it and when
01 Outcome

Day-one access,
and nothing extra.

Maria starts on Monday. She needs accounts in six systems, a laptop, payroll set up, and access to the finance system. Done by hand, that access arrives late — and then, to catch up, someone copies a colleague’s permissions and she ends up able to see far more than her job needs. Here it is ready on day one, sized to her role, with her manager approving the one sensitive system.

02 When it runs

The moment a date is confirmed.

The moment the people team confirms a start date, the agent picks it up — no one has to remember to raise six separate requests. The same happens in reverse on a last day: the agent starts the moment it is confirmed, and everything is closed that day.

start date confirmed→access set up by role→sensitive access approvednothing skipped
03 What it does

Sets people up.
Closes them out.

i
Creates the identity
One record for the person — their role, their manager and their start date — which every other system is set up from.
one record
ii
Grants each system by role
Opens the accounts the role calls for, orders the laptop and sets up payroll. Nothing is copied from a colleague; the role decides.
by role
iii
Asks for approval on the sensitive ones
Access to the finance system waits for the manager. The request says who is asking, for what, and why, and nothing is opened until the answer comes.
a person decides
iv
Revokes on the last day
Every account, every system, closed on the last day, with the time each one ended written down.
on the last day
04 What you get back

A complete record.
Not a trail of emails.

For every joiner and leaver you can see what they were given, who approved it, and when. When an auditor asks who could reach the finance system in March, the answer is one list, not a week of digging through requests.

The agent does the setup and the closing; people still make every decision that matters. The record of each grant and each revocation is kept, with the name of the person who approved it.

05 Extending

Where teams take it next.

  • A
    Choose what needs approval: routine systems open on their own, while payroll, finance and customer data always wait for a named person.
  • B
    One bundle per role — a finance analyst, a support agent and a sales rep each start with their own set of systems, defined once.
  • C
    Handle moves, not just joins: when someone changes team, their access changes with them instead of piling up.
  • D
    Feed the access review: the record of every grant is what makes the quarterly review quick, and it sits alongside the month-end close controls your finance team already runs.
  • E
    Share it across offices: publish the process once and let every country or business unit adopt it, each with its own systems and its own approvers.
All use casesNext: Month-end close →
Joiners and leavers — Xema