Onboard and offboard a user

When an employee joins

1. Invite them or approve their sign-up in “Pending users”.
2. Assign them the role that matches their job.
3. Assign them to the companies they work on.
4. If they approve payments: add them to the relevant approver groups.
5. If they sign at the bank: register them as an EBICS signatory (Banks section).
6. Ask them to enable two-factor authentication when they first sign in.

When an employee leaves

1. Remove them from approver groups and from IBAN approvers.
2. Check that no policy names them as a “Specific user”.
3. Delete their active delegations.
4. Revoke their EBICS signatory access with the bank, then in Arkaio.
5. Deactivate their account.