Offboarding starts when someone gives notice. The riskiest window opens before that. An employee who has already decided to leave, or to take something with them, still holds full trusted access and has not tripped a single leaver process, because on paper nothing has changed.
This is where access-based controls go quiet. The person touches only systems they are entitled to touch, so entitlement reviews see nothing wrong. They export a little more than usual, forward a few documents home, browse repositories adjacent to their work. Each action is individually defensible, and what moves is the pattern while the permissions stay exactly where they were.
Intent Shows Up as Behavior First
Long before a resignation letter, behavior drifts. Access broadens at the edges, volume creeps up, the rhythm of the day changes. None of it violates a rule. All of it departs from the person's own established baseline.
Baseline Catches the Drift
PeopleBase measures each identity against months of its own history, so a trusted employee quietly widening access and raising export volume in their final weeks stands out even when every action stays inside policy. Entitlement checks had nothing to flag, which is why only behavior surfaced it.
By the time notice is given, the data may already be gone. The signal was there in the weeks before, for anyone watching the pattern.
See the latest from Abnormal's product and engineering teams.
