Flag risky 1Password vault access against your HR records

I want an agent that watches who is opening credentials in our shared 1Password vaults and flags access that should not be happening. Trigger it on the 1Password poll trigger for new item usage events, which fires each time an item in a shared vault is accessed or modified. Every event should get reviewed, but only genuinely suspicious ones should ever reach a human.

For each event, read the actor and the item from List Item Usages. Enrich the item with Get Item Details so you know what the credential actually is (title, category, tags, and which system it belongs to) and with Get Vault Details so you know which vault it lives in and how sensitive that vault is. Treat vaults whose name or metadata marks them as production, infrastructure, finance, payroll, or billing as high sensitivity.

Then check the actor against BambooHR using Get Employee Directory. Match the actor to an employee on email address. Do not match on name alone: names repeat across people, change on marriage, and appear in different formats in the two systems, so a name-only match is unreliable and will produce false accusations. If you cannot find an email match, say so plainly in the alert instead of guessing at a person. From the matched record, read employment status, department, job title, and location.

Escalate with Slack Bot Send a Message to our IT channel when any of the following holds. First, the actor is terminated, inactive, or on leave in BambooHR. That is the highest priority case and should be labelled as such. Second, the access lands well outside that person's normal working hours, judged against their location and their own recent access pattern rather than a fixed office clock. Third, the actor opens an item in a production or finance vault for the first time, meaning nothing like it appears in their recent usage history. Fourth, the actor's department has no plausible business reason to hold that credential, for example someone in sales opening a production database login.

Routine access should stay silent. An active employee opening an item they touch every week, from a department that plausibly owns that credential, during their normal hours, is not worth a message. Do not send a heartbeat, a digest, or an all clear. If nothing meets the escalation bar, end the run without posting anything.

Never include the secret value itself in the alert. Get Item Details returns full field values including passwords, API keys, and one-time password secrets. Those must never be written into a Slack message, a log line, or the run output. Refer to the credential only by its title, category, and vault.

Every alert must carry a clear recommendation on whether the credential needs rotating, with a short reason. Recommend rotation when a terminated, inactive, or on-leave employee accessed it: 1Password's own offboarding guidance is to assume offboarded team members have copied shared passwords and to change every password they had access to so any copies they kept stop working. Lean toward rotation for high sensitivity vaults and for shared credentials that cannot be tied back to one person. Lean against rotation for a first-time access by an active employee whose role clearly needs that credential, and in that case say plainly that no action is needed.

Format each message so an IT lead can act on it in seconds: a one-line headline naming the person, the item, and why it was flagged; then the item title, the vault name and its sensitivity, the timestamp with timezone, the client or device the access came from if the event carries it, and the actor's BambooHR status, department, and job title; then the rotation recommendation with its reason. Send one message per flagged event rather than a batched digest, so each one can be worked in its own thread.