IT & Security/First-party starter agent
GitHub offboarding verification
Check a supplied departure list for remaining GitHub access and report gaps without changing accounts.
// what it does
- 01Confirm the review scope. Require the organization, exact usernames and repository list. Exclude future departures and show every approved exception with its reason. Stop if the identity or scope is ambiguous.
- 02Check organization access. Read all pages of organization members and outside collaborators within the configured limit. Match exact usernames. If permission or pagination prevents a full check, mark that surface not checked rather than treating the user as absent.
- 03Check repository access. For each configured repository, read collaborators and pending invitations and look for the supplied usernames. Record the repository, access evidence, and invitation state. An inaccessible repository is not checked, never cleared.
- 04Assemble the exceptions. List remaining memberships, repository access, and invitations separately, with the source URL and observation time. A user is clear within this scope only when every required read completed and no unexcepted path was found.
- 05Return the verification report. Show users supplied, fully checked, with open access, and not fully checked. Include the exact repositories assessed, exceptions, and the next action for a human. Say explicitly that this report does not verify sessions, tokens, deploy keys, personal repositories, or any other system.
// guardrails in the draft
Never remove membership, revoke credentials, cancel invitations, or contact the departed person.
Configure read-only grants before running; these instructions do not enforce permissions themselves.
A hidden membership or denied read is not evidence of absence. Require authenticated visibility of private membership before clearing that surface.
Do not include departure reasons or unrelated personal information in the report.
Do not infer that Okta suspension or removal from one organization ended every access path.
Do not use agent memory as a complete departure register or claim a previous finding is resolved without reading the current state.