# Weekly Tailscale access review against your HR directory > Every Friday, we compare your Tailscale network against your employee directory and flag anyone who left but still has live access. - Workflow type: agent - Services: Tailscale, BambooHR, Slack Bot - Categories: Operations, HR & People - Published: 2026-08-10 ## What it does - Compares everyone with access to your private network against your current employee directory, every Friday morning. - Flags people who have left or no longer appear in the directory but still have a working account, plus anyone whose access level looks higher than their job calls for. - Shows you each flagged person's actual machines and when each one last connected, so you can see exactly what access is still live. - Posts the findings to Slack and waits for your approval before suspending anyone or removing any machines. ## What you'll need - A Tailscale account with admin rights over your network - A BambooHR account, or another supported HR system if you swap out the directory step - A Slack workspace and a channel where the weekly summary should land - Work email addresses that broadly match between Tailscale and your HR records, since that is how people are matched up ## Prompt Every Friday at 7am, cross-check who still has access to my private Tailscale network against who actually still works here, and bring me the mismatches for approval before anything is revoked. Start by pulling two lists. Get the current employee directory from BambooHR using Get Employee Directory, capturing each person's name, work email, job title, department, and employment status. Then get the roster of everyone on my tailnet from Tailscale using List users, capturing each user's id, display name, login email, role, and current status. Match the two lists on email address. Compare case-insensitively and trim whitespace, since HR records and network logins are often entered inconsistently. Where a direct email match fails, fall back to matching on full name and flag that match as lower confidence in the summary rather than treating it as certain. From that comparison, find the accounts that no longer line up. There are three kinds of mismatch I care about. First, people marked as terminated or otherwise inactive in BambooHR who still have an active Tailscale account. Second, Tailscale accounts whose email does not appear in the employee directory at all, which usually means a departure that predates the directory or an account nobody owns. Third, accounts whose Tailscale role looks too high for their job, for example someone in a non-technical role holding Owner or Admin, which is a privilege problem even when the person still works here. For every mismatch, pull that person's machines from Tailscale using List tailnet devices so I can see exactly what access is still live. Filter the device list down to devices owned by that specific user and report each device's name, operating system, tailnet addresses, and when it last connected. The last connected date matters most to me: a laptop belonging to someone who left two months ago that phoned home last week is far more urgent than one that has been dark since they resigned. Post a summary to Slack using Send a Message. List each departed or mismatched person with their HR status, their Tailscale role, every machine they own with its last connected date, and your recommended action for that person. Order the list so the most urgent cases come first, meaning terminated people with recently active devices at the top. Call out anything ambiguous, such as a name-only match or someone who might be a contractor, rather than burying it. Finish the message by asking me to confirm which people to act on, and state plainly that nothing will be changed until I reply. Wait for my approval. Only after I approve, and only for the specific people I name, suspend the account with Suspend a user and remove that person's orphaned machines with Delete a device. Suspend rather than delete the user, because suspension is reversible with Restore a user if we get a match wrong. If I approve some people but not others, act only on the ones I approved. Never touch shared or tagged service machines. Only devices owned by the departed person are eligible for removal. Skip anything that carries a tag, anything shared into the tailnet from another user or tailnet, and any machine that looks like shared infrastructure such as a build runner, subnet router, exit node, or gateway, even when it appears under a departed person's name. When in doubt about a device, leave it alone and flag it in the summary for me to decide. If everything lines up and there are no mismatches, still post a short all-clear to Slack noting how many accounts and devices were checked, so I know the review actually ran. After I approve and you act, post a short follow-up to Slack confirming exactly which accounts were suspended and which devices were removed, and note anything that failed so it can be handled by hand. ## How to customize - Change the schedule. Friday at 7am is the default, but monthly works just as well for smaller teams. - Choose which channel or person receives the summary, and whether quiet weeks still get an all-clear message. - Adjust what counts as too much access for a given job title, and list any people or machines that should always be skipped. ## Example output Tailscale access review, Friday 7:00am 3 accounts need attention. 1. Dana Whitfield (dana.whitfield@acme.com) HR status: Terminated, last day 2026-06-30 (40 days ago) Tailscale role: Member, account still active Machines owned by Dana: - dana-macbook-pro, macOS, last connected 2026-08-06 (3 days ago) - dana-iphone, iOS, last connected 2026-07-28 (12 days ago) Recommended: suspend the account and remove both machines. Note the laptop connected 3 days ago, well after the last day. 2. Marcus Bell (marcus.bell@acme.com) HR status: Not found in the employee directory Tailscale role: Member, account still active Machines owned by Marcus: - mbell-thinkpad, Linux, last connected 2026-04-11 (120 days ago) Recommended: confirm whether this is a contractor before acting. No recent activity. 3. Priya Raghunathan (priya.r@acme.com) HR status: Active, Marketing Coordinator Tailscale role: Owner Machines owned by Priya: - priya-macbook-air, macOS, last connected 2026-08-09 (today) Recommended: keep the account, downgrade the role. Owner access looks too high for this job. Skipped: 4 tagged service machines (tag:ci, tag:gateway) and 2 shared devices. Reply with the names you approve and I will suspend those accounts and remove only the machines owned by them. Nothing happens until you do. ## FAQ ### Will this remove anyone's access automatically? No. The weekly summary is read-only. Nothing is suspended and no machine is removed until you reply and approve the specific people listed. If you never reply, nothing happens. ### What if it flags someone who actually still works here? That is why the approval step exists. You simply do not approve that person. Even if one slips through, accounts are suspended rather than deleted, and a suspended account can be restored without the person losing their history. ### What happens to shared machines and servers? They are left alone. Only machines owned by the departed person are considered for removal. Shared devices and tagged service machines like build servers or gateways are explicitly skipped, so infrastructure never goes down because someone left. ### Do I have to use BambooHR? BambooHR is the default employee directory here, but you can point that step at another supported HR or identity system if that is where your joiners and leavers actually live. ### Our identity provider does not sync employee status into Tailscale. Does this still help? That is exactly the gap this fills. Without automatic user syncing in place, Tailscale expects you to suspend departed people by hand, which is easy to forget for months. This turns that manual chore into a weekly prompt with the evidence already gathered. Use this prompt in General Input: https://www.generalinput.com/prompts/weekly-tailscale-access-review-against-your-hr-directory