Weekly Tailscale access review against your HR directory

Every Friday at 7am, cross-check who still has access to my private Tailscale network against who actually still works here, and bring me the mismatches for approval before anything is revoked.

Start by pulling two lists. Get the current employee directory from BambooHR using Get Employee Directory, capturing each person's name, work email, job title, department, and employment status. Then get the roster of everyone on my tailnet from Tailscale using List users, capturing each user's id, display name, login email, role, and current status.

Match the two lists on email address. Compare case-insensitively and trim whitespace, since HR records and network logins are often entered inconsistently. Where a direct email match fails, fall back to matching on full name and flag that match as lower confidence in the summary rather than treating it as certain.

From that comparison, find the accounts that no longer line up. There are three kinds of mismatch I care about. First, people marked as terminated or otherwise inactive in BambooHR who still have an active Tailscale account. Second, Tailscale accounts whose email does not appear in the employee directory at all, which usually means a departure that predates the directory or an account nobody owns. Third, accounts whose Tailscale role looks too high for their job, for example someone in a non-technical role holding Owner or Admin, which is a privilege problem even when the person still works here.

For every mismatch, pull that person's machines from Tailscale using List tailnet devices so I can see exactly what access is still live. Filter the device list down to devices owned by that specific user and report each device's name, operating system, tailnet addresses, and when it last connected. The last connected date matters most to me: a laptop belonging to someone who left two months ago that phoned home last week is far more urgent than one that has been dark since they resigned.

Post a summary to Slack using Send a Message. List each departed or mismatched person with their HR status, their Tailscale role, every machine they own with its last connected date, and your recommended action for that person. Order the list so the most urgent cases come first, meaning terminated people with recently active devices at the top. Call out anything ambiguous, such as a name-only match or someone who might be a contractor, rather than burying it. Finish the message by asking me to confirm which people to act on, and state plainly that nothing will be changed until I reply.

Wait for my approval. Only after I approve, and only for the specific people I name, suspend the account with Suspend a user and remove that person's orphaned machines with Delete a device. Suspend rather than delete the user, because suspension is reversible with Restore a user if we get a match wrong. If I approve some people but not others, act only on the ones I approved.

Never touch shared or tagged service machines. Only devices owned by the departed person are eligible for removal. Skip anything that carries a tag, anything shared into the tailnet from another user or tailnet, and any machine that looks like shared infrastructure such as a build runner, subnet router, exit node, or gateway, even when it appears under a departed person's name. When in doubt about a device, leave it alone and flag it in the summary for me to decide.

If everything lines up and there are no mismatches, still post a short all-clear to Slack noting how many accounts and devices were checked, so I know the review actually ran.

After I approve and you act, post a short follow-up to Slack confirming exactly which accounts were suspended and which devices were removed, and note anything that failed so it can be handled by hand.