IT onboarding provisioner

Orchestrates new-hire IT onboarding — creates the provisioning ticket tree across systems from the role's access template, tracks completion, chases owners, and gates privileged grants behind human approval. Use when the user mentions new hire setup, onboarding provisioning, employee day-one access, or an HR system signals an upcoming start date.

Day-one access is a promise the whole company makes and IT alone keeps. The checklist spans five systems and three owners, and one missed step means a new hire spending their first week watching other people work. This skill runs the checklist as a system: template in, ticket tree out, privileged grants gated, nothing forgotten because nothing is remembered by hand.

When to run

HR sync signals a start date (recommended trigger, T-minus 10 business days)
"Provision access for the new AE starting Monday"

Computer scopes

HR sync: new-hire record (role, team, manager, start date)
IT: access templates by role, provisioning queues, asset inventory
Directory: system owners and approvers of record

Workflow

Resolve the role template: the approved access baseline for this role/team. If no template exists, stop and route to IT to define one — never improvise an access list.
Generate the ticket tree: one task per system grant, hardware, and account creation, each assigned to its owner with the start-date-derived deadline.
Split the tree: standard grants proceed at L2 (auto-created, audited); privileged grants (admin, finance, production, customer-data) are drafted at L3-gated and require the named approver's sign-off individually.
Track completion daily; chase owners on slipping tasks with escalating reminders; escalate to IT lead at T-minus 2 with anything still open.
On start date, produce the day-one readiness report; on completion, write the full grant manifest to the audit log for future access reviews.

Guardrails

Autonomy: L2 for standard template grants; L3-gated for every privileged grant — individually approved, never bulk-approved.
Access comes only from the approved template; deviations require IT approval and are logged as exceptions.
Offboarding is out of scope for this skill by design — revocation is its own gated workflow.

Output

The ticket tree with owners and deadlines; daily status until complete; day-one readiness report; final grant manifest to audit log.

Eval fixtures

Set: 12 role scenarios against sandbox templates, including 3 with privileged grants and 2 with missing templates.
Rubric: tree completeness vs. template; privileged items correctly gated 100%; missing-template cases halt correctly; deadline math correct.
Ship gate: gating compliance 100%; template coverage errors 0.

Run it onboarding provisioner on your own data.

MORE SKILLS

IT Service Desk · L1

Access request reviewer

Evaluates system and data access requests against written access policy — role fit, least privilege, duration, precedent — and drafts an approval or denial rationale for the human reviewer. Use when the user mentions access requests, permission reviews, access approvals, or an access-request queue needs processing.

IT Service Desk · L1

Access request reviewer

Evaluates system and data access requests against written access policy — role fit, least privilege, duration, precedent — and drafts an approval or denial rationale for the human reviewer. Use when the user mentions access requests, permission reviews, access approvals, or an access-request queue needs processing.

IT Service Desk · L1

Incident comms scribe

Drafts incident communications during outages — status-page updates, internal stakeholder briefs, and customer-facing notices — while maintaining the incident timeline document, all from the live incident channel and monitoring context in Computer. Use when an incident is declared, the user mentions status page updates, incident comms, outage communication, or post-incident summary.

IT Service Desk · L1

Incident comms scribe

Drafts incident communications during outages — status-page updates, internal stakeholder briefs, and customer-facing notices — while maintaining the incident timeline document, all from the live incident channel and monitoring context in Computer. Use when an incident is declared, the user mentions status page updates, incident comms, outage communication, or post-incident summary.