Automation Philosophy
Workforce automation requires special care due to the personal nature of employee data and the critical timing of JML events. Missed onboarding tasks create poor employee experiences, while delayed offboarding creates security risks.
- Timing is critical - onboarding must complete before day one, offboarding must happen immediately
- Personal data compliance - automations must respect GDPR and data retention policies
- Clear escalation - progressive alerts with clear owners at each stage
- Audit trails - log all automated actions for compliance
JML Automation: Onboarding Provisioning
JML-01: New Employee Provisioning Trigger
When a new Employee record is created with Status = Active, automatically initiate IT asset provisioning, software access requests, and training enrollment.
Trigger Condition:
Object created: Employee
Condition: Status = "Active"
Action 1 - Create IT Asset Provisioning Task:
Action 2 - Create Software Access Tasks:
-- Determine access package based on department
-- For Engineering department:
Applications: GitHub, AWS Console, Jira, Confluence, Slack
-- For Sales department:
Applications: Salesforce, HubSpot, Slack, Zoom
-- For all employees:
Applications: Email, Microsoft 365, Slack
Action 3 - Send Welcome Notification:
JML Automation: Pre-Start Date Check
JML-02: Onboarding Readiness Alert
Seven days before an employee's Start Date, verify all onboarding tasks are on track and alert if provisioning is incomplete.
Query - Employees starting within 7 days:
objectType = "Employee"
AND Status = "Active"
AND "Start Date" > now()
AND "Start Date" < now(7d)
Check IT Asset Assignment:
objectType = "IT Asset"
AND "Assigned To" = "{{employee.Key}}"
AND "Asset Type" = "Laptop"
Alert if Incomplete:
Escalation Path:
| Days Until Start | Action | Recipients |
|---|---|---|
| 7 days | Information notification | IT Service Desk |
| 3 days | Alert | IT Manager, HR |
| 1 day | Escalation | Department Manager, HR Director |
JML Automation: Offboarding Access Revocation
JML-03: Employee Termination Offboarding
When an Employee status changes to Terminated, immediately revoke all software access and initiate IT asset recovery.
Trigger:
Object updated: Employee
Condition: Status changed to "Terminated"
Action 1 - Revoke All Software Access:
objectType = "Software Access"
AND Employee = "{{object.Key}}"
AND Status = "Active"
-- For each record:
-- Update Status = "Revoked"
-- Add note: "Access revoked due to employee termination on {{now}}"
Action 2 - Create Asset Recovery Tasks:
objectType = "IT Asset"
AND "Assigned To" = "{{object.Key}}"
AND Status = "Assigned"
Action 3 - Delete Emergency Contacts (GDPR Compliance):
objectType = "Emergency Contact"
AND Employee = "{{object.Key}}"
-- For each contact: Delete object (no retention required)
-- Log deletion for audit
JML Automation: Contractor End Date
JML-04: Contractor Expiry Monitoring
Monitor contractor end dates and automatically initiate offboarding when contracts expire.
Query - 30-day warning:
objectType = "Contractor"
AND Status = "Active"
AND "End Date" < now(30d)
AND "End Date" > now()
30-Day Notice:
7-Day Final Notice:
JML Automation: Internal Transfer
JML-05: Internal Transfer Access Review
When an employee's Department or Role changes, trigger an access review to ensure appropriate access for the new position.
Trigger:
Object updated: Employee
Condition: Department changed OR Role changed
Create Access Review Task:
Certification Expiry Automation
CE-01: Certification Expiry Warning (90/60/30 Days)
Send progressive alerts as certifications approach expiration to allow time for renewal.
Query - 90-day warning:
objectType = "Employee Certification"
AND Status = "Active"
AND "Expiry Date" > now(89d)
AND "Expiry Date" < now(91d)
Query - 60-day warning:
objectType = "Employee Certification"
AND Status = "Active"
AND "Expiry Date" > now(59d)
AND "Expiry Date" < now(61d)
Query - 30-day warning:
objectType = "Employee Certification"
AND Status = "Active"
AND "Expiry Date" > now(29d)
AND "Expiry Date" < now(31d)
90-Day Notice (Information):
30-Day Notice (Urgent):
Certification Auto-Expiry
CE-02: Automatic Status Update
Automatically update certification status to Expired when the expiry date passes.
Query:
objectType = "Employee Certification"
AND Status = "Active"
AND "Expiry Date" < now()
Actions:
- Update Status = "Expired"
- Add note: "Certification expired automatically on {{now}}"
- Send notification to employee and manager
- If required certification for role, create compliance alert task
Access Review Automation
AR-01: Quarterly Access Certification
Generate access certification lists for managers to review and certify their team's application access.
Generate Certification Lists by Manager:
objectType = "Software Access"
AND Status = "Active"
AND Employee.Manager = "{{manager.Key}}"
Certification Task:
Privileged Access Review
AR-02: Monthly Admin Access Review
More frequent review of administrative and privileged access for security compliance.
Query:
objectType = "Software Access"
AND Status = "Active"
AND "Access Level" IN ("Admin", "Power User")
Report Content:
- Admin Access Grants: count by application
- Power User Access Grants: count by application
- New Privileged Access (Last 30 Days)
- Users per application with grant dates
IT Asset Lifecycle Automation
AL-01: Asset Assignment Notification
When an IT Asset is assigned to an employee, notify them and their manager.
Trigger:
Object updated: IT Asset
Condition: Assigned To changed from EMPTY to a value
AND Status = "Assigned"
Notification:
Equipment Refresh Automation
AL-02: Equipment Refresh Due
Identify assets approaching end-of-life for proactive refresh planning.
Query - Assets older than 3 years:
objectType = "IT Asset"
AND Status = "Assigned"
AND "Assignment Date" < now(-1095d)
Report Content:
- Employee, asset name, type, make/model
- Age in years and months
- Department grouping
- Summary by asset type (laptops, desktops, other)
Data Quality Automation
DQ-01: Terminated Employee Compliance Check
Daily check to ensure terminated employees have no active resources - a critical security compliance check.
Query - Active access for terminated employees:
objectType = "Software Access"
AND Status = "Active"
AND Employee.Status = "Terminated"
Query - Assigned assets for terminated employees:
objectType = "IT Asset"
AND Status = "Assigned"
AND "Assigned To".Status = "Terminated"
Alert if Violations Found:
Automation Schedule Summary
Daily Automations
| Automation | Time | Priority |
|---|---|---|
| Certification Auto-Expiry | 01:00 AM | High |
| Terminated Employee Compliance | 06:00 AM | Critical |
| Contractor End Date Check | 07:00 AM | High |
| Pre-Start Date Check | 08:00 AM | High |
| Certification Expiry Warnings | 08:00 AM | Medium |
Weekly Automations
| Automation | Day/Time | Priority |
|---|---|---|
| Employee Data Completeness | Monday 08:00 AM | Medium |
| Contractor End Date Validation | Monday 08:00 AM | Medium |
Monthly Automations
| Automation | Schedule | Priority |
|---|---|---|
| Privileged Access Review | First Monday 09:00 AM | High |
| Equipment Refresh Report | First Monday 09:00 AM | Medium |
| Skills Inventory Reminder | First Monday | Low |
Quarterly Automations
| Automation | Schedule | Priority |
|---|---|---|
| Access Certification | First Monday of Q1/Q2/Q3/Q4 | High |
| Skills Gap Analysis | First Monday of Quarter | Medium |
Real-Time Automations
| Automation | Trigger | Priority |
|---|---|---|
| Onboarding Provisioning | Employee created (Active) | High |
| Offboarding Access Revocation | Status changed to Terminated | Critical |
| Internal Transfer Review | Department/Role changed | Medium |
| Asset Assignment Notification | Assigned To changed | Low |
Troubleshooting
JML Automation Issues
| Issue | Cause | Solution |
|---|---|---|
| Onboarding tasks not creating | Employee Status not "Active" on create | Ensure Status = "Active" when creating Employee |
| Offboarding not revoking all access | Timing issues or query syntax | Test AQL query in Assets search first |
| Duplicate onboarding tasks | Trigger firing multiple times | Add flag attribute to mark "processed" |
Certification Automation Issues
| Issue | Cause | Solution |
|---|---|---|
| Expiry alerts not sending | Expiry Date not populated | Calculate Expiry Date on certificate creation |
| Wrong certifications expiring | Date comparison logic error | Use < now() not <= now() for "already expired" |
Common AQL Patterns
| Pattern | Query |
|---|---|
| Active employees | objectType = "Employee" AND Status = "Active" |
| Employees starting soon | "Start Date" > now() AND "Start Date" < now(7d) |
| Expiring certifications | "Expiry Date" > now(29d) AND "Expiry Date" < now(31d) |
| Assets older than 3 years | "Assignment Date" < now(-1095d) |
| Terminated with active access | Employee.Status = "Terminated" AND Status = "Active" |
Schema Forge