---
title: "Remove access within a day of leaving · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/audit-logs-and-access/offboarding-within-a-day
updated: 2026-10-20
licence: "All rights reserved"
---

# Remove access within a day of leaving

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Audit logs and access](https://agentwranglers.se/playbook/compliance/audit-logs-and-access)
- Rule: Disable every account of a person who leaves within 24 hours of their last day, and rotate any shared secret they knew.
- How: Put every tool you can behind single sign-on, so one switch in the identity provider closes most doors. Keep a list of the tools outside single sign-on and close each by hand from a checklist. Rotate shared keys and passwords the person could read. Move their duties to a new owner first, as in [named owners](https://agentwranglers.se/playbook/compliance/scope-and-ownership/named-owners).
- Check: A script compares leaving dates from the HR system with the deactivation times in the identity provider and in each tool outside single sign-on. It fails when any gap passes 24 hours.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/audit-logs-and-access/offboarding-within-a-day`.

- Previous: [Review access every quarter](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/access-reviews)
- Next: [Grant admin rights only for a set time](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/just-in-time-admin)
- [Audit logs and access](https://agentwranglers.se/playbook/compliance/audit-logs-and-access)