Offboard a developer

One action for "this person has left". Classic offboarding checklists cover email and
VPN but never reach AI tooling — API keys sitting in tool configs, live logged-in
assistants, MCP credentials, gateway tokens.
How
Users & Teams → Developers → Offboard on their row → confirm.
What happens, immediately
Every device they registered is revoked. Their gateway tokens stop working, so
their AI tools lose access at the Gateway — even if their laptop is offline, off, or
never comes back.
Every passkey is removed, so they cannot sign in to enrol a new device.
A receipt is recorded — how many devices and passkeys were revoked, by whom, and
when — and the person shows as 
Offboarded in the table.
Their seat is freed for someone else.
What it does not do
It does not reach into the laptop and delete files. If the machine is still under your
control and online, the Endpoint Suite also removes the Sentilai routing from the tool
configs; if it isn't, access is dead at the Gateway regardless, which is the part that
matters.
Offboarding an admin
Not a one-click action yet. Revoke their pending invites and remove their passkeys from
Users & Teams; a dedicated admin offboarding flow is on the roadmap.