# Build a credential rotation checklist when someone leaves

> When someone leaves, we check which shared passwords they used in their final months and post a ranked rotation list to your security channel.

- Workflow type: agent
- Services: 1Password, Rippling, Slack Bot, Jira
- Categories: Operations, Engineering
- Published: 2026-08-10

## What it does

- Checks your HR system every weekday morning for anyone who just left the company.
- Looks back over their final 90 days to see exactly which shared passwords and company logins they opened, and how often.
- Ranks what genuinely needs changing, putting shared production and admin logins first while ignoring their personal items and anything already switched off.
- Posts a per person rotation checklist to your security channel and opens one ticket per credential, assigned to whoever owns that vault.

## What you'll need

- A 1Password Business or Enterprise account with activity reporting enabled
- A Rippling account where employee departures and last days are recorded
- A Slack workspace and the security channel you want the checklist posted to
- A Jira project where the rotation tickets should be created

## Prompt

Every weekday at 7am, check Rippling for anyone who has just left the company. Use List Workers with a filter on employment status to find workers who are terminated, and keep only the people whose termination took effect in the last day so each departure is reported exactly once. Expand the worker records so I have the person's name, work email, department, manager, and last day, which I need to identify them in 1Password. If nobody left, stop quietly without posting anything.

For each departure, pull their credential history from 1Password with List Item Usages, covering the 90 days up to and including their last day. Narrow the usage feed to the departing person by matching on their work email or 1Password account, and page through with the cursor until there are no more results so nothing is missed. Record, for every item they touched, when they last opened it and how many times they opened it, splitting the count into their final two weeks versus the earlier baseline.

Enrich the results so the report names real credentials instead of raw identifiers. Use Get Item Details for each item they touched to read its title, category, and tags, and Get Vault Details for each vault to read the vault name, description, and owner. Cache every lookup so a credential accessed fifty times is only fetched once.

Also run List Audit Events for that person over the same window, paying close attention to their final week. I want to catch anything they changed on the way out: new or updated item sharing links, vault permission and membership changes, items moved or exported, and any access they granted to themselves or to others. Report these separately from ordinary day to day access, because a sharing link created the day before someone leaves is the highest risk signal in the whole review.

Work out which credentials genuinely need rotating rather than listing everything the person ever opened. Weight upward: items in shared or production vaults, admin and infrastructure credentials such as root cloud accounts, package publishing tokens, CI and deploy keys, database access, and VPN or network gear, and anything accessed unusually often in their final two weeks compared with their earlier baseline. Weight downward or exclude entirely: items in their own private vault, personal items, credentials already deprovisioned or deleted, and single sign-on logins that are already revoked by disabling their identity. Give each credential that survives an urgency of critical, high, or medium, along with a one line reason a security lead can act on.

Post one message per departing person to my security channel using Send a Message in Slack, ordered most urgent first. Lead with the person's name, department, last day, and how many credentials need rotating, then give the ranked checklist with the credential title, the vault name, the urgency, when they last opened it, how often they used it in their final two weeks, and why it made the list. Finish with a short section for the last minute sharing and permission changes from the audit events, and a line noting what was deliberately skipped, such as private vault items and already revoked logins. If several people left the same day, post a separate message for each, most urgent person first.

Then open one Jira issue per credential that needs rotating using Create Issue. Title each issue with the credential and vault name, for example "Rotate: AWS Root Account (Production Infrastructure vault)". In the description include who left, their last day, when they last accessed the credential, how often they used it, the urgency and the reasoning behind it. Assign the issue to the vault owner where the vault metadata identifies one, and fall back to the security channel owner when it does not. Map the urgency onto the Jira priority field, and do not create an issue if one already exists for the same credential and the same departure.

One important detail about 1Password: it exposes two separate APIs with separate tokens and separate base URLs. The Events API covers item usage and audit events, while the Connect server covers item and vault details, and a token issued for one does not authenticate against the other. This workflow may therefore need two distinct 1Password connections. If only an Events connection is available, still produce the full report and the rotation ranking, but refer to credentials and vaults by their identifiers and note in the Slack message that titles could not be resolved. Never fail the run just because the enrichment lookups are unavailable.

## How to customize

- Change the timing: run it every weekday at 7am, daily including weekends, or only on the days your people team processes exits.
- Adjust the lookback window: 90 days suits most teams, but regulated environments often review a full year.
- Tune what counts as urgent, for example always treating anything in a production vault as critical, or widening the list to include credentials the person only opened once.

## Example output

Offboarding credential review: Dana Whitfield (Platform Engineering)
Last day: Thursday 6 August. 6 credentials need rotating.

1. CRITICAL - AWS Root Account (Production Infrastructure)
   Last opened 5 Aug, 14 times in final two weeks vs 2 in the prior baseline. Shared production vault, infrastructure credential.
2. CRITICAL - npm Publish Token (Release Engineering)
   Last opened 4 Aug. Package publishing credential in a shared vault.
3. HIGH - Postgres primary (Production Infrastructure)
   Last opened 1 Aug, 5 times in final two weeks. Shared production database access.
4. HIGH - Datadog Admin (Observability)
   Last opened 31 Jul. Admin level item in a shared vault.
5. MEDIUM - Cloudflare DNS (Production Infrastructure)
   Last opened 24 Jul, twice. Shared vault, no unusual late activity.
6. MEDIUM - Staging VPN (Engineering Shared)
   Last opened 22 Jul. Shared vault, lower blast radius.

Last minute changes worth a look:
- Created an item sharing link for npm Publish Token on 5 Aug, one day before departure.
- Added themselves to the Release Engineering vault on 4 Aug.

Skipped: 23 items in their private vault, and 4 single sign-on logins already revoked with their identity.
Jira: 6 rotation issues opened and assigned to the vault owners.

## FAQ

### Does this change any passwords automatically?

No. It tells you what to rotate and creates the tickets to track it, but every actual password change stays in your hands. That keeps a person in the loop before anything that could break a live system gets touched.

### Will it flag every password the person ever opened?

No, and that is the point. It sets aside personal items and anything already deprovisioned, then ranks what is left so your team starts with the shared production and admin logins that actually matter instead of a list of hundreds.

### What if we use a different HR system?

The workflow only needs a reliable list of who left and when. It comes set up for Rippling, but it can be pointed at another HR platform that records termination dates.

### What happens on a day when nobody left?

Nothing gets posted. The workflow only speaks up when there is a real departure to review, so your security channel stays quiet the rest of the time.

### Do we need a paid 1Password plan?

Yes. You need a business plan that includes activity reporting, because the checklist is built from the record of which items were opened and when. Personal and family plans do not offer it.

Use this prompt in General Input: https://www.generalinput.com/prompts/build-a-credential-rotation-checklist-when-someone-leaves