Skip to content

Onboarding and Offboarding

Access changes for employees and contractors must follow the Access Control Policy and be recorded in Linear.

1. Onboarding

When an employee or contractor joins ClaraRx, the responsible manager must identify the systems and permissions required for the individual's role.

The onboarding process must include:

  1. Confirmation of the individual's role and start date.
  2. Identification of required permissions using the RBAC Matrix.
  3. Approval of the required access through the access request process.
  4. Provisioning by an authorized administrator.
  5. Verification of access where appropriate.
  6. Updating the Access Management Register.
  7. Retention of the completed onboarding record in Linear.

Additional privileged or production access must be requested and approved separately where it is not included in the individual's standard role.

Access must not be granted before the required authorization has been obtained.

2. Role Changes and Access Modifications

When an employee changes responsibilities, transfers teams, or requires different permissions, the required access must be reassessed.

The responsible manager or Engineering Lead must identify permissions that need to be added, modified, or removed.

The process must include:

  1. Review of the individual's existing permissions.
  2. Approval of any new or elevated permissions.
  3. Removal of permissions that are no longer required.
  4. Provisioning of approved changes.
  5. Updating the Access Management Register.
  6. Recording the changes in Linear.

Existing permissions must not automatically remain authorized merely because they were approved for a previous role.

3. Offboarding and Access Revocation

When an employee or contractor leaves ClaraRx, their access must be revoked no later than the effective end of their authorization, coordinated with the departure process.

For involuntary terminations or other urgent security situations, access must be revoked at the appropriate effective time in coordination with the responsible company personnel.

The offboarding process must include, as applicable:

  • Google Workspace.
  • GitHub.
  • AWS.
  • Fly.io.
  • Cloudflare.
  • Xata.
  • Infisical.
  • Sentry.
  • Linear.
  • Monitoring and logging systems.
  • Other systems accessible to the individual.

The process must also consider:

  • Personal access tokens and API keys.
  • SSH keys and other authentication credentials.
  • Active sessions and application-specific credentials.
  • Shared credentials to which the individual had access.
  • Ownership of repositories, services, scheduled jobs, and other operational resources.

Credentials must be rotated when necessary to prevent continued access by the departing individual.

The DevOps Engineer or relevant system administrator must verify revocation where practicable, update the Access Management Register, and record completion in Linear.

The offboarding record must identify any outstanding revocations, explain the reason for the delay, and document remediation.