A friendly reminder from someone who has seen it go wrong: if one person (or one contractor) leaving your team could lock you out of your own systems, you don't have an operations problem — you have a single point of failure wearing an operations costume.
The checklist below is the offboarding/onboarding hygiene we run for managed infrastructure. It's boring, which is why most teams skip it until the day they can't.
The 10-point checklist
- No personal accounts own production resources. Every cloud project, repo, and registrar domain sits under a team-owned account. The human's login is a member, never the owner.
- Shared credentials live in a vault, not a spreadsheet. If you can't rotate every password the departed person knew in 20 minutes, the vault is lying to you.
- Two people can always reach the master keys. The dead-man's principle: if one person is hit by a bus, the other can still get in — and vice versa, so no single person is the key.
- API tokens are per-person and expire. A departed admin's token should die the same day, automatically. Static tokens that live for years are how former contractors quietly keep access.
- Offboarding is a script, not a mood. One runbook: disable, rotate, revoke, audit, confirm. It runs the same way every time, even at 6 PM on a Friday when the person is leaving angry.
- Access reviews quarterly. Pull the list of humans with admin on each system, compare against payroll. Every quarter, something is on the list that shouldn't be. Every quarter.
- Break-glass credentials tested. The emergency admin account gets used (in a sandbox) monthly. An untested break-glass account is a decoration.
- MFA everywhere, with recovery codes vaulted. Losing access because the person with the recovery codes left is a classic — and completely preventable.
- Audit log reviewed after every departure. Not because you distrust the person, but because you should verify the script worked. This catches the "token nobody remembered existed" case.
- The vendor list is current. Half of offboarding failures are vendor-side: the monitoring SaaS, the DNS provider, the backup service nobody remembered the org owned until renewal failed.
Where it lives
The checklist as an executable runbook (with the rotation scripts and audit queries) is in the Ops Starter Kit ($14) — it's the single highest-leverage $14 in ops if your team is above 3 people. The monitoring layer that alerts on anomalous access patterns is the Agent-Ops 24/7 kit. Both are one-time purchases on Gumroad, plain files, yours forever.
Question for the comments: ever been locked out of your own infrastructure? How did you get back in?
