Employee Onboarding — IT Provisioning with AI agents

The HR side of onboarding gets attention because it's visible; the IT side — accounts, access, hardware, security baseline — gets attention only when it's missing on day one and a new hire is sitting there unable to log in. An agent provisions accounts, assigns the right access groups based on role, ships the security baseline, and confirms every piece is actually working before day one starts, instead of IT finding out something's broken from a confused Slack message at 9am.

How it works today vs. with Neotask

IT provisioning for a new hire touches identity, device management, password vaulting, and source control access — four systems that each need a correct, role-specific configuration, and that correctness has real security consequences if it's wrong. Over-provisioning access "to be safe" creates a standing security liability; under-provisioning means a blocked new hire and a scramble ticket on day one. Doing this by hand for every new hire means an IT admin holds a mental map of exactly which access group maps to which role, re-derives it each time from memory or a stale wiki page, and manually checks off each system rather than having a single source of truth drive every provisioning step consistently.

The agent flow

Create the identity the moment the role is confirmed

The agent provisions the new hire's core identity and SSO account ahead of their start date, using the confirmed role to determine which access tier applies.

Integration: auth0

Assign role-based access groups

Repository, environment, and tool access get mapped from a maintained role-to-access matrix rather than copied from whichever previous hire seemed similar, avoiding the silent access creep of "just give them what the last person had."

Integration: github

Provision the credential vault

A personal vault is set up with the shared team credentials the role actually requires, scoped to only those vaults — not the full company vault — following least-privilege by default.

Integration: 1password

Ship and enroll the device

Hardware ships against the confirmed start date, with the security baseline (disk encryption, MDM enrollment, endpoint protection) confirmed installed and reporting in before day one rather than assumed complete.

Integration: crowdstrike

Run a pre-day-one access verification

The day before start, the agent actually tests that the new account can authenticate, reach the assigned repos, and unlock the assigned vaults — catching a broken step while there's still time to fix it.

Notify IT and the manager of readiness (or gaps)

A go/no-go status lands in the IT channel the morning before start: fully provisioned, or a specific named gap that needs attention before 9am.

Integration: slack

Variations

• For contractors with a fixed end date, the same flow adds an automatic de-provisioning step scheduled for the contract end date, so access doesn't silently linger past the engagement.
• Companies using Okta instead of Auth0 for SSO run the identical role-matrix and verification logic against Okta's admin API.
• A higher-security variant adds a manager sign-off step before any credential vault access is granted, for roles touching production secrets or customer data.

Frequently asked questions

How does it know what access a role needs?

From a maintained role-to-access matrix that IT owns and updates — the agent applies that matrix consistently rather than improvising per hire.

What if the pre-day-one check finds a broken step?

It's flagged immediately with the specific failure (e.g., "vault access denied for finance-shared") so IT can fix it before the new hire's first morning instead of during it.

Does it handle hardware shipping logistics?

It triggers the shipping request and tracks confirmation of MDM enrollment once the device checks in — the physical logistics still run through your existing hardware vendor.

Is access ever over-provisioned by default?

No — the design is least-privilege by default, granting only what the role matrix specifies rather than a broad default that gets trimmed later.

Plans

Continue