Administration & Setups
How an administrator tailors the module: grant the twelve permissions, then shape what a case does through the Setups tabs — templates, separation types, the task catalog, owners and sign-offs, SLA and escalation rules, integration connectors, and general/security settings — plus the Automation page for versioned workflows.
The twelve permissions
While the module is enabled, these keys appear in the Roles editor. The base offboarding
permit is the master key — everything else layers on top of it. Administrators have all of them by
default.
| Permission | Grants |
|---|---|
offboarding | Master key — see the Offboarding menu, the Checklist, and read cases. |
offboarding_create | Start new offboarding cases. |
offboarding_update | Edit case details and work items. |
offboarding_delete | Delete / cancel cases. |
offboarding_clearance | Run final clearance and approve exception closures (the controlled gate). |
offboarding_immediate | Initiate — and, under dual approval, confirm — immediate separations. |
offboarding_confidential | Read the reason and details of confidential cases. |
offboarding_signoff | Approve or reject department sign-offs. |
offboarding_actions | Verify, complete, fail, and retry account/access actions. |
offboarding_assets | Record asset outcomes and their condition/evidence. |
offboarding_automation | Open the Automation page — versions, dry runs, run history. |
offboarding_setups | Open the Setups page and change templates, types, catalog, and settings. |
Setups tabs
Open Offboarding → Setups (needs offboarding_setups). Each tab configures one part
of what a case does.
Checklist Templates
A template is the blueprint for a separation type. Templates are versioned and immutable once published — existing cases keep the exact version they started with, so history never shifts under you. Editing a published template creates a new draft; a brand-new template starts as draft v0.1. Build the draft's tasks from the catalog, then publish it to make it usable.
Separation Types
Four system types ship seeded; you can add tenant-defined types:
| Type | Trigger model | Notes |
|---|---|---|
| Voluntary Resignation | Scheduled | Standard notice-period departure. |
| Immediate Separation | On-demand + confidential | Same-day, security-sensitive; actions execute at once. |
| End of Contract | Date-based | Anchored to the contract end date. |
| Retirement | Date-based | Anchored to the retirement date. |
Task Catalog
The reusable library of tasks a template can include. Each catalog task defines:
Owners & Sign-offs
Defines each department sign-off gate: the gate name, the resolver that picks its signatory, a fallback (the case owner) when no signatory resolves, a due offset, which separation types it applies to, and whether it is a final gate that must pass before the case can close.
SLA & Escalations
Controls the timing of reminders and escalations that the hourly cron raises:
| Setting | Default | Effect |
|---|---|---|
| Reminder lead hours | 24 | How far ahead of a due time a reminder is sent. |
| Escalation lead hours | 8 | How overdue an item is before it escalates. |
| Block failed actions | On | A failed access action counts as a clearance blocker until resolved. |
Integrations (connectors)
Six connector slots configure where access actions are performed. External connectors run in manual-verification mode in this version — no outbound call is made; an operator confirms each action in the provider and records it here.
| Connector | Kind | Status in this version |
|---|---|---|
| Microsoft Entra ID | External | Manual verification |
| Google Workspace | External | Manual verification |
| SCIM / REST | External | Manual verification |
| Outbound Webhooks | External | Manual verification |
| ERPat Asset Registry | Internal | Live |
| ERPat Notifications | Internal | Live |
General & Security settings
| Setting | Purpose / default |
|---|---|
| Closure gate policy | Whether clearance requires tasks + sign-offs or everything (tasks, assets, access, sign-offs). |
| Allow exception closure | Permit closing a case with open items via an approved exception. |
| Prevent duplicate open cases | Block a second active case for the same employee. |
| Auto-create draft cases | Create draft cases from the resigned / terminated employee flags for review. |
| Allow manual start | Permit operators to start cases by hand. |
| Dual approval for immediate | Require a second immediate-permission holder to confirm an immediate separation. |
| Default account containment action | Suspend, lock, or manual — the default access action applied on separation. |
| Data transfer recipient rule | Who inherits mailbox/drive/data ownership by default. |
| Post-offboarding deletion delay | Days to wait before a delete step is due. |
| Require asset evidence / condition | Force evidence and/or condition when recording asset outcomes. |
| Confidential reason visibility | Restrict who can read confidential case reasons. |
| Case number prefix | Default OFB. |
| Default last-day time | Default 18:00. |
| Audit retention | Years to keep case activity records. |
Automation page
Open Offboarding → Automation (needs offboarding_automation) to manage versioned
workflow definitions. Versions move draft → published → retired, and you can clone as
draft to iterate safely.
- Publish validation refuses to publish a version that has no tasks, a dependency cycle, or a missing named owner.
- Dry run simulates a workflow without changing data, so you can confirm it does what you expect before publishing.
- Run history records every execution with its attempts, so failures and retries are traceable.
Automation needs the cron ticking
Time-based releases and reminders depend on the two Advanced Cron jobs. Confirm they are registered and being ticked:
php erpat cron:list # expect offboarding_scheduler (every 10 min) and offboarding_reminders (hourly)
php erpat cron:tick # run whatever is due now| Job | Schedule | Role |
|---|---|---|
offboarding_scheduler | Every 10 minutes | Releases due work — access actions to awaiting verification, tasks to ready, case-state progression. |
offboarding_reminders | Hourly | Reminders as SLA lead times approach; escalations on overdue items. |