Offboarding and AI access: what happens when an employee or seasonal worker leaves

The offboarding checklist forgot AI

Most companies have an offboarding routine. Return the laptop, deactivate the email account, remove the person from the ERP and change the door code.

AI tools rarely appear on that list. Yet in many businesses, a departing employee still has:

• a personal ChatGPT or Claude account with chats containing customer exports,
• an AI app connected to the company’s shop with their own login,
• a configuration file or a chat with an ERP API token, often one created by somebody else,
• automations they built that keep running with those credentials.

Deactivating their ERP user does not touch any of this if the token belongs to a colleague. That colleague is often the managing director, because they had “the right permissions”.

Why pasted tokens make offboarding painful

A token pasted into a chat or script has no idea who is using it. To be sure that a departing person has lost access, you have to:

1. Create a new token.
2. Find and update every script, automation and person that used the old one.
3. Revoke the old token and hope nothing important breaks.

This step is easy to forget, and a token can stay valid for a long time.

Seasonal staff make it a routine problem

Hotels, restaurants, garden centers and retailers hire dozens of seasonal workers every year. If AI access depends on shared logins or individual setups, every season ends with the same question: who still has access?

How Steward makes offboarding simple

Steward separates people from credentials:

• The weclapp token, Shopify app credentials or ASA login are entered once by an administrator. They are stored encrypted and never shown to anyone, including the AI. Colleagues never receive a copy. Create the weclapp token for a dedicated weclapp user rather than a person’s own account: if the token owner’s account is deactivated, the connection stops working.
• People receive access through the workspace, projects and connection permissions, ideally through teams.

When someone leaves, you remove their access. You do not rotate the company’s keys.

The two-minute offboarding

1. Remove the person from their teams in Settings → Teams. Project and connection access granted through those teams ends. See people and teams.
2. Check direct grants. Access given directly to the person, not through a team, must be removed separately in project Sharing and connection Access. See check access when responsibilities change.
3. Remove them from the workspace in Settings → People.
4. Review scheduled tasks they created or that run as them, and assign or recreate them as needed. See scheduled task permissions.

Their conversations, proposals and approvals stay in the company’s projects. The record of what they did does not leave with them. See Who approved that?

Set up for the next season, not just this one

The best time to plan offboarding is when you onboard:

• Create teams by role, for example “Reception”, “Housekeeping”, “Seasonal F&B” or “Warehouse”, and grant project and connection access to the team, not to individuals.
• Project roles. Viewers follow results, Contributors use configured connections and prepare changes, and Managers approve. Invited project members need no separate connection grant.
• Keep approvals with permanent staff. Charges, refunds and price changes should be approved by someone who will still be there next month.
• Use invitations, not shared accounts. Every person gets their own sign-in. See people and teams.
• At the end of the season, empty the seasonal team in one step.

A simple quarterly review

Once a quarter, a workspace administrator should check:

• who is in each team,
• which people have direct grants on connections,
• who has Approve and Configure access,
• which scheduled tasks exist and what they can access.

If you used pasted tokens before

1. Create new credentials in weclapp, Shopify or ASA, and connect them in Steward only.
2. Revoke the old tokens.
3. Ask staff to delete chats that contain tokens or customer exports.
4. Add “AI tools” to your offboarding checklist.

See Should you paste your API token into ChatGPT? for the full checklist.

Get started

Create teams, grant project roles and connection permissions to teams, and make AI access part of your onboarding and offboarding from now on.