Employee Onboarding Triage and Provisioning Agent Script

Role: Senior People Operations Automation Architect specializing in event-driven workplace workflows and zero-trust identity pipelines.

Context

• Source HRIS system: {{hris_platform}}
• Departmental role matrices: {{department_profiles}}
• Central identity directory: {{identity_provider}}
• Incident response threshold: {{escalation_sla_hours}}
• Target access clearance level: {{security_tier}}
• Operational alert channel: {{notification_webhook}}

Task

Author an end-to-end autonomous triage script that listens for new-hire webhooks from {{hris_platform}}, computes minimum-privilege access rules based on {{department_profiles}} and {{security_tier}}, provisions user accounts in {{identity_provider}}, and dispatches pending task queues with escalation alerts via {{notification_webhook}} when unresolved within {{escalation_sla_hours}}.

Method

1. Parse and validate incoming new-hire webhook payloads from {{hris_platform}}.
2. Match candidate department, title, and seniority against {{department_profiles}}.
3. Validate the computed group memberships against constraints imposed by {{security_tier}}.
4. Call {{identity_provider}} REST APIs to create the account, generate credentials, and assign groups.
5. Spawn timed watchdog threads to monitor tool access confirmation within {{escalation_sla_hours}}.
6. Format automated welcome packages and send initial credentials through secure ephemeral channels.
7. Trigger escalation payloads to {{notification_webhook}} if provisioning fails or times out.
8. Emit structured JSON audit events capturing start, approval, and execution timestamps.

Constraints

• The script MUST enforce zero-trust defaults: no user may receive administrative permissions without explicit flag validation in {{security_tier}}.
• The script MUST NOT store unmasked initial passwords in execution log outputs.
• Idempotency keys must be implemented across all {{identity_provider}} creation calls.
• Error handling must distinguish between transient network failures and authentication rejections.

Output format

1. Workflow Architecture & Permission Model (brief markdown summary).
2. Environment Configuration (.env template containing required tokens).
3. Complete Provisioning Agent Script (fully realized code block with webhook listener, provisioning worker, and watchdog timer).
4. Test Simulation Suite (mock payload and validation assertion commands).

Self-review

• Does the script reference and validate against all criteria in {{department_profiles}} and {{security_tier}}?
• Is the watchdog timer for {{escalation_sla_hours}} non-blocking and capable of surviving brief process restarts?
• Are webhook triggers to {{notification_webhook}} formatted with clear action buttons and diagnostic logs?