Offboard a developer

One action for "this person has left". Classic offboarding checklists cover email and VPN but never reach AI tooling — API keys sitting in tool configs, live logged-in assistants, MCP credentials, gateway tokens.

How

Users & Teams → Developers → Offboard on their row → confirm.

What happens, immediately

• Every device they registered is revoked. Their gateway tokens stop working, so their AI tools lose access at the Gateway — even if their laptop is offline, off, or never comes back.
• Every passkey is removed, so they cannot sign in to enrol a new device.
• A receipt is recorded — how many devices and passkeys were revoked, by whom, and when — and the person shows as Offboarded in the table.

Their seat is freed for someone else.

What it does not do

It does not reach into the laptop and delete files. If the machine is still under your control and online, the Endpoint Suite also removes the Sentilai routing from the tool configs; if it isn't, access is dead at the Gateway regardless, which is the part that matters.

Offboarding an admin

Not a one-click action yet. Revoke their pending invites and remove their passkeys from Users & Teams; a dedicated admin offboarding flow is on the roadmap.

Every developer row carries Offboard — one click revokes their AI access and frees the seat.