Offboarding: revoke access,
don't just remove it

The gap in ordinary offboarding

Disabling someone's directory account stops them signing in. It does nothing about what they already know. Every shared password they ever revealed, exported, or memorised keeps working until it is changed, and "we'll rotate the important ones" reliably decays into rotating none of them. The uncomfortable truth: in a team that shares credentials through chat or spreadsheets, offboarding is not actually possible. Nobody knows the full set of secrets a person saw, so nobody can rotate it.

Administrative vs cryptographic revocation

Administrative revocation flips a permission bit: the system will no longer show the person the secret. The secret itself is unchanged; the risk that they retained it is untouched.

Cryptographic revocation changes the mathematics: the vaults the person could open are re-encrypted under a fresh key, and every credential inside is now due for rotation, with the vault telling you exactly which ones those are. In Keyvaci, revoking a member from a vault does this re-encryption automatically on your device, resumably if interrupted, and writes the whole operation to the append-only audit log. What their old key material could ever decrypt no longer exists on the server.

The checklist

1. Before the exit conversation: list every vault the person can enter. This should be one query, not an investigation.
2. At exit: suspend the directory account. If sign-in rides your directory through Entra ID SSO, vault sign-in dies with it, immediately and for free.
3. Same day: revoke their vault access, which re-encrypts those vaults, then rotate the credentials they actually revealed recently. The audit log tells you which ones those were; rotate those first, the rest on schedule.
4. Within a week: transfer ownership of anything they owned: API keys, registrar accounts, the credentials nobody else knew existed. Check the audit trail for unusual reveal activity in their final weeks; departing-employee data grabs are a pattern, not a paranoia.

The 30-minute drill

Pick a volunteer. Pretend they resigned an hour ago. Time how long it takes to (a) list what they could open, (b) cut their sign-in, (c) re-encrypt what they had, and (d) name the ten credentials to rotate first. Under 30 minutes with records to prove it: your process works. Anything else: you have found the project to do before the real resignation letter arrives. The buyer's guide includes this drill in a full one-week evaluation.