Offboarding is a security event. Five years ago, offboarding an employee mostly meant paying out any remaining funds to them and collecting back any company property such as laptops, etc. Today that same employee may hold admin keys to production servers, have API tokens dropped onto shared password vaults and have remote access to client environments. And it takes only one person to not trigger revocation an hour after offboarding has been triggered in the people function.
TradingFXVPS runs its infrastructure to prevent large amounts of damage being caused by stale credentials to servers that deal with lots of money trading. I have seen it take 9 days for the account of a former contractor to expire while he thought he was no longer active. It all worked out fine for us but that was pure luck.
So in order to adapt to this, we have now tied HR identity to the same mechanical process that we use to onboard people. So in essence, HR now effectively owns identity for us. HR is the source of truth for who has access to what, and we're all operating under a bunch of assumptions that haven't been written down in terms of job descriptions. A role change and/or exit in HR automatically opens up access for review and corresponding tickets for revocation that need to be processed within a 2-hr time frame for terminations.
The main thing that leaders of people need to understand is what each role can actually do. In order to create a sensible access policy for a team, you need to understand the difference between read-only monitoring and root access on a production server. I review the permission map for our teams with our people leads on a quarterly basis with our ops team, going through line by line.
Culture still matters though. A good people leader is only half a modern job if they can't tell you who has root on any given day.