Chapter 12 — Joiners

Chapter 12 — Joiners

Lesson map

Lesson 12 published. Map, example, EX034.

flowchart TD
  N0["Learning outcomes"]
  N1["12.1 Starting from HR"]
  N2["12.2 Day-one readiness"]
  N3["12.3 Exceptions"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX034"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["12.1 Starting from HR"]
  N2["12.2 Day-one readiness"]
  N3["12.3 Exceptions"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX034"]

[Learning outcomes]
    |
    v
[12.1 Starting from HR]
    |
    v
[12.2 Day-one readiness]
    |
    v
[12.3 Exceptions]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX034]

Learning outcomes

You will (1) design a joiner process; (2) link it to HR; (3) give access ready on day one.

12.1 Starting from HR

A joiner's access should begin from an HR record, not an email to IT. Kai agrees with HR that each new starter is entered with name, role, clinic, start date and employment type at least five working days before the start. That record triggers account creation with the role's groups. Starting from HR means every account has a person behind it, a recorded reason and a start date, and avoids accounts created informally that nobody later remembers to remove. HR also benefits, because the form is short and the same each time.

12.2 Day-one readiness

New vets and nurses need access on their first day to work safely with patients. Kai's process creates the account three days before the start date, disabled, and enables it on the start date. The new starter receives instructions to set up multi-factor authentication during induction with a manager present. The practice manager tests the process with two new nurses and both can work on day one, with their accounts having only the access their role defines. Managers receive a short checklist so the first morning runs the same at every clinic.

12.3 Exceptions

Some joiners need extra access, such as a vet who also helps with finance. Exceptions are requested by the manager, approved by the owner of the extra group and recorded with a reason and review date. Kai keeps exceptions visible in a list rather than hidden in group memberships, so reviews can check whether they are still needed. Without that visibility, exceptions quietly become permanent and the role table stops describing what people actually hold. Each review date appears in the quarterly review list automatically.

Worked example

Two nurse joiners start with role access on day one; one vet exception is recorded with a review date.

Synthetic case. Staff and dates are synthetic.

Errors and limits

Creating accounts from informal emails produces accounts nobody remembers to remove.

Exercises

• EX034 — Lead time. How early should HR enter a new starter? Rubric: 3 = at least five working days before;; 2 = five days;; 1 = on the day;; 0 = none.
• EX035 — Account timing. When is the account created and enabled? Rubric: 3 = created three days before disabled, enabled on start date;; 2 = before;; 1 = after;; 0 = none.
• EX036 — Exception record. What is recorded for an exception? Rubric: 3 = reason and review date, owner approval;; 2 = reason;; 1 = vague;; 0 = none.

Synthesis

HR-triggered joiner processes give correct access on day one with recorded exceptions.

Continue studying — chapter 12 of 30

← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →