Use caseWorkflow automationKnowledge and search

Onboarding that provisions accounts only after approval, and answers new starters' questions

Onboarding automation from a signed contract: access plans IT approves, accounts created through APIs, a first-week checklist and a handbook assistant.

A blueprint, not a client story. The business described is illustrative; the architecture, integrations and trade-offs are real, and this is how I would build it. By Ergini, September 11, 2026.

The short version

Onboarding automation for companies hiring monthly in several countries. When a contract is signed in Personio, HiBob or BambooHR, it drafts an access plan from the role's template, IT approves it in Slack, and code creates the accounts in Google Workspace or Microsoft 365, Okta or Entra ID, Slack, Jira and GitHub. A checklist tracks equipment, documents and first-week meetings, and an assistant answers new starters from the handbook with citations. Offboarding runs in reverse. The model never grants access.

Best for: Companies of 50 to 500 people hiring every month in more than one country, on a mix of Google or Microsoft, Slack and engineering tools.
Connects to: HRIS (Personio, HiBob or BambooHR), Google Workspace, Microsoft 365, Okta or Microsoft Entra ID, Slack, Jira Service Management and GitHub, Handbook (Notion, Confluence or Google Drive)
The AI does: Drafts each new starter's access plan from the role template and the manager's notes, and answers handbook questions with a link to the page it used.
People do: IT approves every access plan, HR owns the country checklists and every sensitive question, and managers plan the first week.
Built as: AI Workflow Automation, usually $15K - $30K

Eight new starters a month and a checklist nobody trusts

Consider a 120-person software company with people in Germany, the Netherlands and Spain, hiring about eight a month: mostly employees, some contractors, a few through an employer of record. The HRIS knows the moment a contract is signed. Everything after that runs on a shared checklist, three Slack channels and one IT person's memory.

The costs are small and constant. HR spends days per hire bouncing between IT, email and three systems. A salesperson inherits a finance folder because access was copied from a colleague, and the Dutch new starter is sent the German tax form.

Offboarding is worse, because nobody notices when it fails. A contractor's Slack account stays active two months after the contract ended. A leaver is still in the GitHub organization, so their personal access tokens still reach the code. These gaps surface in a security review or a customer's audit questionnaire, usually at the worst moment.

Every hand-off between a signed contract and day one

Traced step by step, a typical joiner passes through these hands. Any hand-off can stall without anyone noticing.

HR marks the contract signed in the HRIS and posts the start date in an onboarding channel.
IT asks the manager which tools the person needs, and waits.
IT creates the Google or Microsoft account, then the identity-provider user, then copies groups from a colleague with a similar job.
Someone orders a laptop, often too late for easy shipping to another country.
HR emails the country's payroll documents and chases each one by hand.
The manager is asked to book first-week meetings and pick a buddy, and skips it when the week is busy.
Engineers ask for GitHub and Jira access on their first morning.
The new starter asks HR the same twenty questions everyone asks in month one.

Offboarding is the same list run backwards, from memory, usually on a Friday afternoon.

From a signed contract to a working first morning

The model drafts; it never acts and never holds admin credentials. Everything that creates, changes or removes access is ordinary code executing a plan a person approved, the pattern behind human-in-the-loop design.

01 Trigger · HRIS API
The contract is signed in the HRIS
A webhook, or a poll where the HRIS has none, delivers the new starter: role, department, country, manager, start date and employment type (employee, contractor or employer-of-record hire).
02 Plain code
Load the role template
Each role maps to a versioned template: identity-provider groups, licenses, Slack channels, GitHub teams, the equipment profile and the country checklist. IT and HR own the templates; nothing in them is generated.
03 AI model · Structured output
Draft the access plan
A model reads the template and the hiring manager's notes, such as 'needs the client's Jira project and read access to the data warehouse', and proposes a plan in a fixed schema. Anything beyond the template is marked as an exception, citing the sentence that asked for it.
04 Plain code
Check the plan against policy
Rules test every line: approved groups only, no admin roles, no 'same as another user', elevated access always time-limited. Failing lines are removed and listed for the approver, never silently kept.
05 Person · Slack interactive message
IT approves in Slack
The approver sees the plan as a difference from the template, exceptions first, and approves, edits or rejects it under their own name. Exceptions also need the system's owner, such as the head of data for warehouse access.
06 System · Okta or Entra, Admin SDK or Graph, GitHub REST API
Create the accounts
Code executes the approved plan: identity-provider user and groups, which provision SCIM-connected apps; mailbox and license; GitHub team invitation; a Jira Service Management ticket for the laptop. Every action has an idempotency key, so a retry cannot create a second account.
07 Decision
Did every action take effect?
Checked by reading each account back, not by trusting the API response.
- Every account confirmed then welcome pack sent with first-day instructions
- An API call failed or timed out then retried with the same key, then a Jira ticket with the error
- The start date moved or the offer was withdrawn then pending actions canceled, created accounts suspended
08 Person
HR and the manager close the checklist
HR collects the country documents; the manager books first-week meetings and names a buddy. Overdue items are visible to everyone involved, and the Slack reminders come from the workflow rather than someone's memory.
09 Result
An access record per person
Every grant is stored against the employee with its approver and expiry: the record offboarding reverses and an auditor asks to see.

One approved plan, line by line

The plan for an account executive joining the Madrid office. The first four lines came from the template; the rest came from the manager's notes and needed extra approval.

Access	Granted through	Approved by	Ends
Google Workspace mailbox; sales and Spain office groups	Admin SDK Directory API	Role template	At offboarding
Okta groups for sales and the CRM	Okta API; the CRM account follows by SCIM	Role template	At offboarding
Slack account and the sales and Madrid channels	Slack SCIM and conversations.invite	Role template	At offboarding
Laptop with a Spanish keyboard and the sales device profile	Jira Service Management ticket	Role template	Returned at offboarding
Read access to the pricing workbook	Google Drive folder share	Head of sales operations	90 days, then reviewed
A partner's Slack Connect channel	Slack Connect invitation	IT and the partner's owner	Partnership end date
Admin role in the CRM	Not granted	Removed by the policy check	-

The manager asked for CRM admin because the previous account executive had it. The policy check removed it before any person saw the plan, which is how copied access stops spreading.

Offboarding is the half that has to be right

When the HRIS records a last day, the access record runs in reverse. At the end of that day in the leaver's time zone, code suspends the identity-provider account: in Entra ID, sign-in is blocked and Graph's revokeSignInSessions invalidates refresh tokens and browser sessions; in Okta, the user is deactivated, sessions are cleared and SCIM-connected apps are deprovisioned. Removing GitHub organization membership ends their tokens' access to the company's repositories.

Some steps need a person, and the workflow asks rather than guesses. The manager picks who inherits the leaver's Drive files, moved with Google's Data Transfer API, or whether the Microsoft 365 mailbox becomes a shared mailbox. IT confirms the laptop is back. Shared credentials the person could see, such as a vault folder or a cloud root account, get a rotation task with an owner and a date.

Urgent exits skip the schedule: when HR marks a termination as immediate, revocation runs the moment they confirm. Every night, a reconciliation job compares each system's user list with active employees in the HRIS, and any account without a matching person is reported the next morning. That is how access granted outside the workflow gets found.

Day three: a handbook question, then a personal one

The assistant lives in Slack, answers from the handbook with a source, and spots questions that belong to HR before writing anything.

Slack direct message, Wednesday 16 September

On day one, the assistant introduced itself as an AI and said what it can and cannot help with, as Article 50 of the EU AI Act expects of systems that talk to people.
New starter · Slack
How do I book holiday, and who approves it?
search_handbook(query: "book holiday approval", country: "ES")1 passage / "Time off, Spain" (updated 3 Mar 2026): request in Personio under Time off, manager approves, 4 weeks' notice for more than 10 working days in a row
Assistant · Slack
You book holiday in Personio under Time off, and your manager approves it. For more than ten working days in a row, the policy asks for four weeks' notice. Source: Time off, Spain (updated 3 March 2026).
New starter · Slack
Thanks. Something more personal: I need surgery in November. Could that be a problem during my probation?
classify_topic(message)health, probation / sensitive: route to HR / no handbook answer
open_hr_case(employee: "E-2291", topic: "health, probation", visibility: "HR only")case HR-318 / assigned to the HR partner for Spain / message text stored in the case only
Assistant · Slack
That one is for a person rather than me. I've passed it privately to your HR partner for Spain, who will reply to you directly, normally within one working day. Only HR can see it.
The assistant's log keeps only the topic label and case number; the question itself lives in the HR case, under HR's access rules.

Pay, health, performance, contracts, immigration and conflicts with colleagues go to HR. Everything else is answered from the handbook only, with the retrieval setup of an internal knowledge assistant scoped to new starters.

Failure modes this build is designed around

Access copied from a colleague

'Give her what Marco has' is how over-provisioning spreads, because Marco's access carries three years of exceptions. The workflow has no copy function: access comes from the role template plus approved exceptions, each exception expires, and a quarterly review lists those still active.

Accounts that outlive the job

Contractors and mid-month leavers are the usual gaps. Every account the workflow creates carries its owner's HRIS ID, the nightly reconciliation flags anything without an active match, and contractor access ends on the contract end date unless someone extends it on purpose.

The wrong country's paperwork

A German new starter provides a tax ID, social security number and health insurer; a Dutch one completes a payroll tax declaration and the employer keeps a copy of their ID; a Spanish one fills in Modelo 145. HR owns these checklists per country and employment type, employer-of-record hires follow the provider's list, and the model never decides what a country requires.

The assistant answering a legal question

'Can they end my contract during probation?' looks like a handbook question and is not one. Questions touching contracts, dismissal, pay, health, pregnancy, immigration or a dispute with a colleague are classified before any answer is written and routed to HR, and so is anything the classifier is unsure about.

A handbook that went stale

Every answer shows its page and when that page was last updated, pages older than a year are flagged to their owners, and unanswered questions become a weekly list for HR, which usually says more about the handbook than the assistant. The approach is in building an internal knowledge base.

Logs that start to look like monitoring

A log of who asked what can become a record of employees' behavior. In Germany, technical systems that can monitor employees need the works council's agreement under section 87(1) no. 6 BetrVG, so questions are logged without names by default, sensitive topics stay out of the log, and a works agreement sets who sees what. Using the assistant to evaluate new starters would make it a different system: the AI Act lists evaluating workers' behavior as high-risk.

Earning the right to create accounts unattended

Granting access is where mistakes cost most, so automation expands a step at a time. Revocation is automated from week one: a leaver keeping access is a bigger risk than a suspended account that has to be restored.

Stage	What runs automatically	What earns the next stage
Plan only	Access plans and checklists are drafted; IT creates the accounts by hand from the plan.	A month of plans that match what IT would have granted, with no policy violations.
Approved execution	After IT approves, code creates the accounts, starting with the identity provider and adding one system at a time.	A month with no failed or duplicated actions and a clean nightly reconciliation.
Template plans auto-approved	Plans with no exceptions run on HR's signal alone; exceptions still wait for IT and the system owner.	IT agrees, role by role, that template-only plans no longer need a click.

Rippling, your HRIS's own workflows, or a build?

If you are choosing an HRIS now and your stack is standard, look hard at Rippling: it combines the HR record with device management and app provisioning, much of this page in one product. BambooHR, HiBob and Personio handle onboarding checklists, document collection and reminders well, and Okta Workflows or the lifecycle workflows in Microsoft Entra ID Governance can drive joiner and leaver changes from HR data without custom code. For many companies this size, that is enough.

A build earns its place when the stack is mixed and the rules are yours: Google Workspace in two countries and Microsoft 365 in the third, engineers in GitHub and Jira, employer-of-record hires beside employees, approvals that need the system owner as well as IT. It also covers what packaged tools leave out: an assistant that answers from your handbook with citations and knows which questions belong to HR.

The answer I usually recommend is a hybrid. HRIS workflows keep HR's own tasks and the identity provider does the provisioning it already does well; the custom part is the policy check, the approval step, the reconciliation job and the assistant, which can run through your private AI gateway if you have one. That is usually a smaller build than people expect.

How you would know it is working

A blueprint has no results to report, so here is what I would measure from the first week instead, on your own data.

Ready on day one: The share of new starters with every planned account working by 9:00 on their first day, checked by reading each account back.
Time to revoke: Minutes from the end of a leaver's last day to the last account suspended, per system. The target is the same day, every time.
Orphaned accounts: Accounts the nightly reconciliation finds with no active person behind them. The count should reach zero and stay there.
Exceptions per plan: How often plans need access beyond the template. A rising rate means the templates are out of date.
Assistant hand-offs and gaps: Questions routed to HR, and questions the handbook could not answer, reviewed weekly with HR.

What a build like this costs

This is built as AI Workflow Automation, which runs $3.5K - $60K overall. A build like this one usually lands in the multi-step workflow tier: $15K - $30K, 3-5 weeks. The first working version runs on your real data well before the end of that window.

What it costs to run

Mostly hosting plus a little model usage: plans are drafted a few times a month and handbook answers cost fractions of a cent each. Some pieces carry license costs of their own, such as Entra ID Governance for lifecycle workflows or the Slack plan that includes SCIM, so check what you already pay for.

What moves the price

How many systems need API provisioning outside the identity provider, and whether they support SCIM
How many role templates and countries, and who maintains them
Employment types: employees, contractors and employer-of-record hires each follow a different path
The assistant's scope: the handbook only, or also the IT knowledge base and per-country benefits documents
Whether a works council needs a documented configuration and a works agreement before launch

Who this is for

Companies of 50 to 500 people hiring every month, where one or two IT people handle every joiner and leaver
Teams employing people in several European countries, some of them through an employer of record
Companies preparing for SOC 2 or ISO 27001, where auditors ask for evidence that access was removed on time
Businesses on a mixed stack: Google Workspace or Microsoft 365, Okta or Entra ID, Slack, Jira and GitHub

Questions people ask about this

How do I automate onboarding and offboarding?

Start from the HRIS, not a ticket. A signed contract triggers a role template that sets groups, licenses and tools; IT approves the plan; code creates the accounts through each system's API and records every grant. Offboarding reads that record back and reverses it at the end of the last day. Keep most access behind groups in Okta or Entra ID, so both directions are mostly group changes.

Can AI answer new employees' questions about company policy?

Yes, if it answers only from your handbook and shows its source. The assistant here searches the handbook, replies with the passage and a link, and says so when the handbook is silent. Questions about pay, health, contracts or conflicts go to HR instead. It also introduces itself as an AI, as Article 50 of the EU AI Act expects of systems that talk to people.

Does it work with Personio, HiBob or BambooHR?

Yes. The workflow reads joiners and leavers from the HRIS's API, using webhooks where they exist (Personio offers them for employee records) and a short polling interval where they do not. The HRIS stays the source of truth for role, country, manager and dates. HR keeps working there as before; the workflow reacts to what they record.

Is it safe to let automation create and remove accounts?

Safer than doing it by hand, if the automation only executes approved plans. The model drafts plans but holds no credentials, a policy check strips admin roles and copied access, IT approves each plan, and every action is idempotent and verified by reading the account back. Revocation is scheduled from the last day in the HRIS, and a nightly job reports any account nobody owns.

How long does onboarding automation take to build?

Usually three to five weeks for a first version: the HRIS trigger, role templates, the approval step, provisioning through the identity provider and the main tools, offboarding and the nightly reconciliation. The new-starter assistant adds time depending on how tidy the handbook is. More countries, more employment types and systems without SCIM add scope.

Sources