Skip to content

Onboarding / Offboarding Procedure

Supports: ../policies/access-control-policy.md, ../policies/security-awareness-policy.md. Owner: DIR. Evidence: a dated joiner/leaver record (Tier 2 where it names a person).

Purpose

Grant the right access on join and revoke it promptly on leave — the highest- value control once Partile is more than one person. Today the operator is the only identity; this procedure activates at the first hire/contractor.

Onboarding (joiner / role change)

  1. Assign a role — DIR / INFRA / OPS / MOBILE / COUNSEL — and grant only that role's access (least privilege, ../policies/access-control-policy.md).
  2. Provision accounts with MFA: GitHub (with review-required, no force-push to main), and only the consoles the role needs (Google Cloud / Apple / Cloudflare / LinkedIn dev; AWS only if a future reintroduction requires it). Account IDs and credentials stay Tier 2.
  3. Issue secrets via Secret Manager or approved operator secret store, never by chat/email; least-privilege service creds.
  4. Security awareness onboarding (../policies/security-awareness-policy.md): read + acknowledge the core policies; brief on the two-tier rule, incident reporting, and the physical-safety dimension.
  5. Device baseline confirmed (../policies/acceptable-use-and-device-policy.md): FDE, screen lock, current OS.
  6. Record the joiner with role, access granted, and date; trigger an access review of the new identity.

Offboarding (leaver)

Do these promptly on departure (same day for any privileged role):

  1. Revoke application sessions for the person's account.
  2. Remove console access (GitHub, Google Cloud, Apple, Cloudflare, LinkedIn dev, and any AWS access if present) and restricted-store access.
  3. Rotate any shared/service secrets the person could have known (../policies/cryptography-and-secrets-policy.md).
  4. Reclaim/wipe devices holding Partile source or data; de-register mobile test devices.
  5. Reassign ownership of any controls/registers the role owned.
  6. Record the leaver with date and actions; run an access review to confirm no residual grants remain.

Role-change

Treat as offboarding-from-old-role + onboarding-to-new-role for access: remove grants the new role doesn't need; add only what it does.

Done when

Joiner: role-scoped access live, awareness acknowledged, recorded. Leaver: all access revoked, secrets rotated, devices reclaimed, recorded, access review clean.