# Zero-Touch De-Provisioning for HR

*/Opportunities/Zero-Touch_De-Provisioning_for_HR*

## Opportunity Overview

**Wedge**: The initial beachhead targets revoking access to non-SSO marketing and sales tools at high-turnover agencies. This niche feels acute pain because departing employees retain access to sensitive client data and ad spend, creating immediate liability. From this narrow start, the system expands laterally into hardware retrieval logistics and finally integrates with payroll for automated final paycheck calculations.
**Timing**: The proliferation of shadow IT means offboarding is highly fragmented, creating severe security liabilities from orphaned accounts. Concurrent advancements in browser-automation agents allow systems to revoke access even in legacy or non-SSO applications where public APIs do not exist.
**Why This I C P**: Mid-market companies with high turnover experience offboarding as a continuous, high-volume operational drag. They hold significant compliance risks from rogue ex-employees but lack the dedicated IT headcount of massive enterprises to build and maintain custom de-provisioning scripts.
**Size Of Prize**: ~100,000 mid-market and enterprise companies in the US × ~$15,000 annual spend on offboarding labor and IT coordination ≈ $1.5B addressable market.
**Gap Narrative**: When an employee leaves, HR and IT teams currently manually revoke access across scattered SaaS applications, coordinate hardware returns, and process final payroll. Existing identity providers handle single sign-on applications but ignore localized software, physical assets, and compliance documentation. This opportunity executes the complete offboarding sequence autonomously.
**Defensibility**: Defensibility stems from workflow lock-in and a compounding integration library. As the system maps and de-provisions accounts across thousands of obscure SaaS portals, the barrier for competitors to replicate the breadth of coverage increases. Once embedded as the final step in the HR information system, replacing the product forces IT to revert to manual, high-risk security checklists.
**Why This Thesis**: An agentic approach fits structurally because offboarding requires interacting with dozens of vendor-specific admin panels that lack standardized public APIs. Agents navigate these portals to execute deactivation clicks, bridging the gap between SSO-enabled tools and legacy systems without human intervention.

## Opportunity Linked Thesis

**Thesis**: [Software](/Theses/Software)

## Opportunity Linked I C P

**Icp**: [Enterprise Tech Company](/CompanyTypes/Enterprise_Tech_Company)

## Opportunity Market Sizing

_Illustrative — target and order-of-magnitude estimate figures, not an achieved track record (this Thing is concept-stage)._

**S A M**: ~$750M-1B targeting enterprise tech companies
**S O M**: ~$20M-50M
**T A M**: ~100k global large enterprises × ~$50k/yr ≈ $5B
**Growth Rate**: ~15-20%/yr, driven by remote workforce churn, strict access compliance audit requirements, and increasing SaaS application sprawl
**Paid Comparable Spend**: ~$40k-80k/yr per enterprise in manual IT helpdesk labor for offboarding tickets, custom script maintenance, and wasted SaaS seat licenses retained by inactive users

## Opportunity Incumbents

- [Rippling](/Products/Rippling) — Tool
- [Okta Lifecycle Management](/Products/Okta_Lifecycle_Management) — Tool
- [BetterCloud](/Products/BetterCloud) — Tool
- [ServiceNow HRSD](/Products/ServiceNow_HRSD) — Service
- [IT Offboarding Checklists](/Products/IT_Offboarding_Checklists) — Spreadsheet
- [Custom PowerShell Scripts](/Products/Custom_PowerShell_Scripts) — DIY

## Opportunity Win Conditions

**Kill Thresholds**:
- Security approval cycle exceeds 45 days
- Human-in-loop escalation rate > 10% after day 30
- Less than 10 core SaaS applications successfully disconnected automatically
- D60 retention drops below 60%
**Leading Metrics**:
- time-to-first-automated-offboarding (hours)
- percentage of SaaS applications instantly de-provisioned via API
- human-in-loop escalation rate per termination event
- value of abandoned SaaS licenses recovered ($)
- time saved per offboarded employee (minutes)
**What Proves Right**: IT and HR teams deploy the system and achieve a 95% reduction in manual offboarding tickets within the first 30 days. Mid-market and enterprise customers recover at least $5,000 in unused SaaS license spend per month by instantly revoking access upon employee termination. Month-three retention exceeds 90% because the automated workflow becomes a mandatory compliance control for SOC2 audits.
**What Proves Wrong**: Security teams block adoption by refusing to grant broad API permissions to a third-party application. The integration requires constant manual maintenance due to undocumented API changes from downstream SaaS vendors, forcing IT back to custom PowerShell scripts. The failure rate of automated de-provisioning exceeds 5%, causing unauthorized access risks that immediately disqualify the product.

## Opportunity Build Profile

**Hardest Part**: Achieving absolute deterministic reliability across diverse, rate-limited SaaS APIs, where a single missed API call leaves a critical security vulnerability open. Handling silent failures and undocumented state changes in third-party systems without human intervention is the primary engineering hurdle.
**Min Viable Scope**: The system executes instant credential and session revocation strictly for the core IT stack (Google Workspace, Slack, Okta) triggered by a termination status in a single HRIS like BambooHR. Deliberately exclude laptop retrieval logistics, granular data transfer protocols, and physical building access management.
**Cold Start Problem**: Testing requires access to a messy, live corporate SaaS footprint, but early development risks accidentally revoking active employee access. Break this by deploying the v1 entirely in a read-only shadow mode for an initial design partner, surfacing missed revocations against their manual offboarding process to build trust.
**Time To First Value**: 1-2 weeks of initial integration mapping, yielding full value on the first live employee departure.
**Data Moat Available**: false
**Technical Difficulty**: Moderate

## Neighborhood

### Incumbent in

- [ServiceNow HRSD](/Products/ServiceNow_HRSD) — incumbent in · Products
- [Okta Lifecycle Management](/Products/Okta_Lifecycle_Management) — incumbent in · Products
- [Rippling](/Products/Rippling) — incumbent in · Products
- [BetterCloud](/Products/BetterCloud) — incumbent in · Products
- [Custom PowerShell Scripts](/Products/Custom_PowerShell_Scripts) — incumbent in · Products
- [IT Offboarding Checklists](/Products/IT_Offboarding_Checklists) — incumbent in · Products

### Applies thesis

- [Enterprise Tech Company](/CompanyTypes/Enterprise_Tech_Company) — applies thesis · CompanyTypes

### Embodies

- [Software](/Theses/Software) — embodies · Theses

### Similar Opportunities

- [Autonomous Deprovisioning for IT](/Opportunities/Autonomous_Deprovisioning_for_IT) — similar · Opportunities
- [Onboarding Orchestration Agent](/Opportunities/Onboarding_Orchestration_Agent) — similar · Opportunities
- [Identity Lifecycle Automation](/Opportunities/Identity_Lifecycle_Automation) — similar · Opportunities
- [Managed Auth Operations](/Opportunities/Managed_Auth_Operations) — similar · Opportunities
- [Day-One Provisioning Agent](/Opportunities/Day-One_Provisioning_Agent) — similar · Opportunities
- [Autonomous Provisioning for Enterprise IT](/Opportunities/Autonomous_Provisioning_for_Enterprise_IT) — similar · Opportunities
- [Attrition Arbitrage](/Opportunities/Attrition_Arbitrage) — similar · Opportunities
- [Algorithmic Access Auditing for VMOs](/Opportunities/Algorithmic_Access_Auditing_for_VMOs) — similar · Opportunities
- [Automated Evidence Collection](/Opportunities/Automated_Evidence_Collection) — similar · Opportunities
- [Employee IT Provisioning](/Opportunities/Employee_IT_Provisioning) — similar · Opportunities
- [Agency Outbound Automation](/Opportunities/Agency_Outbound_Automation) — similar · Opportunities
- [Account Rescue Operations](/Opportunities/Account_Rescue_Operations) — similar · Opportunities
- [Autonomous L1 Responder](/Opportunities/Autonomous_L1_Responder) — similar · Opportunities
- [Just-In-Time Provisioning for DevOps](/Opportunities/Just-In-Time_Provisioning_for_DevOps) — similar · Opportunities
- [Frontline Retention Desk](/Occupations/Management_Occupations/Opportunities/Frontline_Retention_Desk) — similar · Opportunities
- [Automated Payroll Reconciliation](/Opportunities/Automated_Payroll_Reconciliation) — similar · Opportunities
- [Contract Retention Automation](/Opportunities/Contract_Retention_Automation) — similar · Opportunities
- [Candidate Closing Agent](/Opportunities/Candidate_Closing_Agent) — similar · Opportunities
- [AI Client Onboarding](/Opportunities/AI_Client_Onboarding) — similar · Opportunities
- [Autonomous Task Runner](/Opportunities/Autonomous_Task_Runner) — similar · Opportunities