Offboarding closes the door and keeps the room

An engineer resigns on Friday. Across sixty containers, what did he have access to, and what did he take?

The first answer is one authentication group. His access to every terminal, file surface, and editor was membership in it. Remove him and forty-one URLs stop answering his browser at once. No hunt through authorized_keys, no laptop to retrieve and wipe because nothing lived on the laptop.

The second answer is the record. His terminal sessions are still in history. Every file he changed is still in the journal with a revision. If legal asks what he touched in his last month, ops answers with ?history and a session export, not a guess.