How personnel events work¶

When someone is hired, leaves, changes roles, or takes a leave of absence, their access to applications needs to change. A personnel event is how Permission Assist manages that process — from the initial request through each access change to a final verification that everything was completed correctly. Every action along the way is tracked, giving you a clear record for audits and compliance.

Event types¶

Permission Assist supports four types of personnel events, each one matching a common HR scenario:

A fifth option, Change User, is also available from the Request page. Change User is not a personnel event — it creates an individual request to add, change, remove, suspend, or restore permissions for a specific user account within an application. Use Change User for one-off permission changes that are not related to an HR event. For more information, see Request a change to user permissions.

How the process works¶

Every personnel event follows a structured process. The process is broken into steps, and each event type has its own set of steps. While the specific steps vary, they all follow the same general pattern: approve the request, make the access changes, and verify the results.

Steps by event type¶

How events move forward¶

The first step in every personnel event is Approve. Depending on how your Administrator has configured workflow rules, the Approve step may require decisions from one or more designated approvers — such as a supervisor, a defined manager, or a Security Team member — before it advances. Each approver selects the Approve button to record their decision. As decisions are received, the remaining count updates. The step advances automatically when all required approvals are received.

If no approval rules have been configured, a single authorized person can approve the event directly.

For step-by-step instructions on approving an event, see Approve or verify a personnel event.

Once approved, Permission Assist creates access requests and assigns them to the Provision Team. The middle steps (Provision, Deprovision, Transition, Transition In, Transition Out, Suspend, and Restore) advance automatically as the Provision Team completes each access request — you do not need to do anything during this part of the process.

The final step is Verify. When all access changes are complete, one or more designated verifiers confirm the results by selecting the Verify button. Like the Approve step, verification may require multiple responses if your Administrator has configured verification rules. The event closes when all required verifications are received.

As each step progresses, its status changes from Scheduled or Pending to Open and then to Completed. You can see these statuses on the step progress cards when you view a personnel event. For a full description of each status, see Tracking progress.

What happens after approval¶

When the Approve step is completed, Permission Assist automatically creates access requests for each application affected by the event. An access request is a detailed record that tells the Provision Team exactly what changes need to be made. The type of access request depends on the event type:

These access requests appear on the Provision Team's Change Management Taskboard, where Provision Engineers make the required changes in each application. As access requests are completed, the step automatically advances.

Before the Approve step completes, authorized participants — including approvers, the event reporter, and the event assignee — can adjust which applications are included. This allows your Security Team to account for timing needs, such as holding provisioning for a specific application until training is complete, without canceling the event or breaking the audit trail. Any adjustment is recorded in the event's activity log. For instructions, see Adjust application selection.

How Permission Assist determines what access is needed¶

When you create an onboarding or role transition event, Permission Assist compares the employee's information (such as department, title, and office) against your organization's access models. Access models define what applications and permissions a person should have based on their role. If the employee matches an access model, the right applications and permissions are automatically included in the event.

During this process, you will see two categories of access models:

If your organization's access models are well-defined, most of the work of determining what access a new hire or transitioning employee needs is handled automatically.

Scheduling events¶

Personnel events can be started immediately or scheduled for a future date. Scheduling is useful when you know about an upcoming change in advance — for example, scheduling an onboarding event two weeks before a new employee's start date.

When an event is scheduled, the Provision Team may be able to start working on access changes before the scheduled date. This is based on a configurable working window — the number of days before the scheduled date that work can begin. For example, if the working window is set to 7 days and an onboarding event is needed by March 15, Provision Engineers can begin setting up access as early as March 8.

If you need to change the scheduled date of an event after it has been created, see Change the scheduled start date of a personnel event.

Editing a pending event¶

After creating an onboarding or role transition event, you can update the details before the event is approved. Editing is available while the event has a Pending status — once the Approve step is completed, the event details cannot be changed.

You can update the identity details (name, type, description, and profile photo), organization information (company, division, department, office, title, and supervisor), and access model selections. All edits are recorded in the event's history.

Editing is not available for offboarding or leave of absence events.

• To edit a pending onboarding event, see Edit a pending onboarding event
• To edit a pending role transition event, see Edit a pending role transition event

Snoozing a leave of absence¶

When creating a leave of absence, you may not know when the employee will return. In this case, you can select the Snooze option for the end date. When snoozed:

• The Suspend step proceeds normally — access is suspended on schedule
• The Restore step is paused and displays a Snoozed status
• When the return date is known, the Restore step can be resumed and scheduled

This allows access to be suspended on time without requiring a return date up front.

Tracking progress¶

After a personnel event is created, you can track its progress from the Personnel Events taskboard. To view your personnel events, go to the My Taskboards menu and select Personnel Events. The taskboard displays events organized by type and can be filtered by status:

When you select a personnel event, the step progress cards are displayed. Each card shows the step name, its current status, and (for steps with access requests) the number of completed requests out of the total.

Step statuses¶

Each step within a personnel event displays one of the following statuses:

Reports and audit packages¶

You can generate reports and audit packages for any personnel event:

Related topics¶

• Initiate a personnel event
• Request onboarding
• Request offboarding
• Request role transition
• Request leave of absence
• Request a change to user permissions
• Approve or verify a personnel event
• Add attachments to comments
• Use @mentions to send email notifications