Offboard a privileged user the same day

Reinforce the joiner-mover-leaver order from IAM training. Shared passwords are rotated after the individual's access is killed, not before.

1. Disable the IdP account at the effective time.
2. Disable VPN access.
3. Revoke tokens and keys the same day.
4. Revoke badge access the same day.
5. Remove the person from privileged groups and break-glass lists.
6. Rotate secrets the person could have known.
7. Collect devices and confirm encryption and wipe status.
8. Do not leave a just-in-case mailbox forward on a privileged account.