Prerequisites: the Day one track and task templates. Read employee lifecycle architecture first, because this page assumes its intake and fan-out. For Ravenna to grant access rather than track it, connect an identity provider and read access provisioning.
The shape of it
1
One intake event
A webhook, an alert channel, or a New hire form. All three produce the same fields.
2
A parent ticket in People Ops
The one ticket that answers “where is this up to”.
3
A child ticket per team
Each carries the hire’s data and fires that team’s own workflow.
4
A task template on each child
The work a system cannot do: desk, laptop, buddy, first-week agenda.
5
Group membership for the system work
Requested from the child that owns it, scheduled off the start date.
1. Capture the hire
On the form path, build a New hire form. On the webhook or alert path, this is the field set your trigger prompt should produce.2. Create the task templates
One template per team’s child ticket, holding the work a system cannot do. Write it in the order it happens, since that is the order it keeps, and group it with section headers: Before day one, Day one, First week.The manual steps that come up on every real onboarding:Importing a template sets the ticket’s whole task list, so apply it once, early.
Learn more about task templates
3. Build the workflows
People Ops hands the work out. Each team runs their own half, which is what keeps this maintainable.- People Ops
- Each team, IT as the example
1
Trigger on your intake
Webhook, Ticket Created on the alert channel, or Form Submitted filtered to the New hire form.
2
Create the parent ticket
Webhook path only. The form and alert paths already produced it.
3
Create one child per team
A Create Ticket step each: their workspace, Parent ticket set to the parent, and Form pointed at the intake ticket’s form so the child arrives with the data on it.
4
Announce it
Send Message to the onboarding channel, Send Email to the personal address.
Learn more about the cross-workspace fan-out and Wait Until
Let Copilot build it
Describe the end state and Copilot plans the workflow before creating anything.When the New hire form is submitted, create a child ticket in the IT workspace, one in Facilities, and one in Finance, each with its parent set to the triggering ticket and its form set to the New hire form. Then post the hire's name and start date to #people-ops.
When a ticket is created in the IT onboarding channel, apply the IT onboarding task template. If the department is Engineering, request the Engineering baseline access level. Wait until three days before the start date, then post a reminder to #it-ops to image the laptop.
Learn more about building automations with Copilot
4. Ask the manager for the exceptions
The department bundle covers the standard case, and there is always a second pass. Rather than growing the intake form with every possible tool, send the manager a short form once the base setup is running: “anything beyond the standard setup?”Their answers feed a second provisioning pass on the same child ticket. The intake stays short, the decision sits with the person who knows, and you get a record of why someone has Figma when their department bundle does not include it.5. Decide what needs approval
Most onboarding access should not need approval, because the hire itself was the approval. Gate only the expensive or sensitive tiers: production access, finance systems, admin roles.Attach an access policy to those access levels with an approval template routing to the manager or system owner. Access levels with no policy are auto-approved, which is the right default for a standard bundle.Learn more about access policies and approval flows
6. Handle the parts that fail
Provisioning reaches into other people’s systems, so give yourself a way to see when one does not answer. Three places to look:- A workflow on Entitlement Status Changed for Failed Provisioning, posting to your triage channel
- Workflow failure notifications by Slack or email
- The Entitlements tab under Settings > Applications on the morning of a start date, which shows status and time left per grant
Learn more about entitlements and workflow monitoring
7. Test it on a real hire, with a human watching
Run the whole thing for the next actual new starter, with someone shadowing every step. You will find one missing group and one wrong owner, and it is much cheaper to find them with a person watching.Where teams get this wrong
Per-person access lists
Per-person access lists
Bundle by role and department, or the form grows forever.
One workflow for every team
One workflow for every team
IT, Facilities, and Finance each need their own child ticket and their own workflow.
Everything at the start date
Everything at the start date
Hardware needs lead time. Use negative offsets on Wait Until.
Approvals on standard access
Approvals on standard access
Gating the whole bundle turns a five-minute automation into a two-day wait, and people go around it.
No failure path
No failure path
Watch Failed Provisioning so you catch a missing grant while there is still time to fix it.
Next
Employee offboarding
The same machinery, run in reverse and with a deadline.
Approval flows
Rounds, parallel approvers, and dynamic approvers like the requester’s manager.