Offboard a member
When you remove a member we end their sessions, drop every grant and free the seat. Machine identities, invitations and values they saw need your action.
You remove a member on Settings then Members. Permissions and step-up rules: members and invites.
Effects of removal
We apply all of these in one transaction:
| Object | Effect |
|---|---|
| Membership | We mark it deprovisioned and keep the row |
| Sessions | We revoke every live session in this workspace |
| Grants | We delete every role assignment they hold here, at every scope |
| Seat | Freed. We count only active memberships as seats |
| Audit log | We record member.deprovisioned and member.removed, with you as actor |
Access ends on the member's next request. We refuse two removals: yourself, and the last owner (make another member an owner first). Removing a member requires step-up.
The Audit Log action filter lists member.deprovisioned only. Find member.removed, member.invite_revoked, role.assigned and role.unassigned by actor and date, or in an export. See audit.
Not affected by removal
| Object | State after removal | Action |
|---|---|---|
| Machine identities the member created | Keep working. Identities belong to your workspace | Filter the log by the member as actor for identity.create and credential.issue; revoke under Machine Identities then All Identities (machine:revoke) |
| Invitations the member sent | Live for seven days | Revoke on Settings then Members (member.invite_revoked) |
| Values the member read | Still known to them | Rotate. See a credential leaked |
Revoking a credential leaves the identity able to hold a new one. Revoking the identity stops every credential it holds and cannot be undone. See machine identities.
Directory deprovisioning
SCIM active: false, or a directory delete, runs the same removal, and we record scim as the cause. We mark the row rather than delete it, and count only active memberships as seats. Setting active back to true restores the membership and the seat, not the sessions. See directory sync.
Narrow access
| Grant | Where | Needs | Records |
|---|---|---|---|
| Workspace-wide role | Settings then Members | member:role_assign, never above your own | role.assigned |
| Project or environment grant | Projects, the project, then Access | member:role_assign at that scope | role.assigned or role.unassigned |
A project or environment grant expresses "read staging, nothing in production" without a custom role. See roles and permissions.
History
We keep the log append-only at the database level, and the marked membership keeps the member's name on every entry. See the audit log.
Procedure
Filter the audit log by the member as actor. Note what they touched in the last 90 days.
Find identity.create and credential.issue rows under their name.
Revoke those identities or credentials in Machine Identities, if policy requires it.
Revoke invitations they sent, on Settings then Members.
Remove the member on the same page. For an owner, promote another owner first.
Filter the log by yourself as actor and today's date. Confirm member.deprovisioned and member.removed.
Rotate every production value they could read, most sensitive first.