New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Identity Lifecycle Administration

by cbrock84 in cbrock84/headcount

Executes joiner, mover and leaver processes — provisioning, group membership, access changes on role change, and complete deprovisioning.

MITAuto-check passedSecurity

Install Identity Lifecycle Administration

skills CLI
$ npx skills add cbrock84/headcount --skill identity-lifecycle-administration -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install cbrock84/headcount identity-lifecycle-administration --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/cbrock84/headcount.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/it-operations/skills/identity-lifecycle-administration .claude/skills/identity-lifecycle-administration && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
identity-lifecycle-administration
GitHub stars
2k
Token cost
~964 tokens
SKILL.md length
521 words
Files
2 (incl. references)
Skills in repo
178
Repo updated
First seen
Licence
MIT

At a glance

Executes joiner, mover and leaver processes — provisioning, group membership, access changes on role change, and complete deprovisioning.

  • Tasks that involve Access reviews and audit trails
  • SKILL.md covers Joiners, Movers are the neglected case, Leavers, completely and Recertify, and act on it, plus 3 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Identity Lifecycle Administration is an agent skill from cbrock84/headcount. Executes joiner, mover and leaver processes — provisioning, group membership, access changes on role change, and complete deprovisioning. Use this to set up or fix joiner-mover-leaver, deprovision someone completely, clean up accumulated access, audit group membership, or find accounts that outlived their owners.

Its SKILL.md is about 960 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/sources.md`).

It sits in Security, covering Access reviews and audit trails. The repository describes itself as: An agent organization structured as a company — 15+ departments, 125+ skills, each independently installable, citing the standards and regulators that settle the question. Runs… The licence is MIT.

When your agent uses it

  • Tasks that involve Access reviews and audit trails

Example prompts

  • “Use the identity-lifecycle-administration skill to execute joiner, mover and leaver processes — provisioning, group membership, access changes on…”
  • “/identity-lifecycle-administration”

What it can do on your machine

Read from SKILL.md and the folder at commit 98d1c17. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Identity Lifecycle Administration loads about 964 tokens when it runs, and up to ~1.6k if it reads all its reference files. Until then it costs about 87 tokens; SKILL.md has 521 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~87
When it runs · the whole SKILL.md, loaded when a task matches
~964
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from cbrock84/headcount at commit 98d1c17, republished under its MIT licence (© cbrock84). 521 words, ~964 tokens.

Download SKILL.mdSave it as .claude/skills/identity-lifecycle-administration/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
identity-lifecycle-administration
description
Executes joiner, mover and leaver processes — provisioning, group membership, access changes on role change, and complete deprovisioning. Use this to set up or fix joiner-mover-leaver, deprovision someone completely, clean up accumulated access, audit group membership, or find accounts that outlived their owners.

Identity lifecycle administration

This is execution: creating, changing and removing access as people arrive, move and leave. Policy — what a role should be entitled to, and least privilege — belongs to security:access-and-identity. This skill runs the process that policy defines, and the gap between the two is where most access problems live.

Joiners

Provision from the role, not by copying a colleague. Copying is the single largest source of privilege accumulation: it inherits everything that person collected, including access they should not have had, and it propagates that indefinitely.

Define role-based bundles for the common cases so a standard joiner is one action, and treat anything outside them as an exception requiring approval. Exceptions are fine; unrecorded exceptions are not.

Time provisioning to be complete before the start date — coordinated through people:onboarding-and-offboarding.

Movers are the neglected case

Leavers get attention because someone is going. Movers do not, and so access accrues: the person who has worked in three departments has permissions from all three, and nobody ever removed the first two.

Treat a role change as a revoke and re-provision, not an addition. This is the single highest- value fix available in most organizations, and it is almost always skipped because the person is still present and nothing appears broken.

Leavers, completely

Disable promptly at the agreed time, then work a checklist that reaches past the directory: systems outside single sign-on, local accounts, shared credentials the person knew, API keys and tokens they created, external services procured on a personal login, and any mail or calendar delegation.

The gap is almost always the systems identity management does not reach. Maintain the list of them explicitly rather than discovering it during an audit.

Preserve rather than delete where there is any prospect of investigation or legal hold — deletion is irreversible and occasionally very expensive.

Show full SKILL.md (219 more words)Show less

Recertify, and act on it

Periodically, system owners confirm who should still have access. This is worth doing only if non-response defaults to removal; where non-response means retain, recertification becomes a formality that certifies whatever exists.

Hunt specifically for orphaned accounts — accounts with no owner, service accounts nobody claims, and credentials that have not been used in months but still work.

Sources

references/sources.md in this skill lists the outside authorities that settle the questions here — what each one is authoritative for, and what you may do with it. Check them before answering on anything they cover, and cite what you used. Most are free to read and not free to reproduce; the use note on each is binding.

Tooling

Directory and SSO: Microsoft Entra ID, Okta, Google Workspace, JumpCloud, and similar.

HRIS as the trigger: Workday, BambooHR, Rippling, HiBob, Gusto, ADP, and similar. Identity should follow the HRIS record rather than a separate list of who works here.

Provisioning runs on SCIM wherever the application supports it. Where it does not, the joiner-mover-leaver steps are manual and belong in a ticket template, not in someone's head.

Never

  • Provision by copying an existing user.
  • Add access on a role change without removing the old.
  • Consider a leaver deprovisioned when the directory account is disabled.
  • Run recertification where non-response means retain.

© cbrock84, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in plugins/it-operations/skills/identity-lifecycle-administration of cbrock84/headcount.

  • SKILL.md
  • references/sources.md

Open the folder on GitHubat commit 98d1c17

Compare with similar skills

Identity Lifecycle Administration next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Identity Lifecycle Administration compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Identity Lifecycle Administration this skillcbrock84/headcount2k—~964Automated safety check: PassMIT
Google Cloud PAM Helpergoogle/skills21k—~3.2kAutomated safety check: PassApache-2.0
OmniRoute Audit and Policy CLIdiegosouzapw/OmniRoute74k—~733Automated safety check: PassMIT
Access Reviewsickn33/agentic-awesome-skills47k2 repos~3.6kAutomated safety check: PassMIT
Admin Access Registersickn33/agentic-awesome-skills47k1 repos~4.2kAutomated safety check: PassMIT
Implementing Identity Verification For Zero Trustmukul975/Anthropic-Cybersecurity-Skills34k—~2.4kAutomated safety check: PassApache-2.0

Similar skills

  • Google Cloud PAM Helper

    google/skills

    Official

    Manages Google Cloud Privileged Access Manager entitlements and grants: create and edit entitlements, request temporary access, and approve or deny pending grants.

    21k GitHub stars~3.2k tokensUpdated today
    SecurityAuto-check passed

  • OmniRoute Audit and Policy CLI

    diegosouzapw/OmniRoute

    Command reference for omniroute's audit, logs, policy and telemetry commands: search and export audit trails, manage access policies and review request history for compliance work.

    74k GitHub stars~733 tokensUpdated today
    SecurityAuto-check passed

  • Access Review

    sickn33/agentic-awesome-skills

    Conduct periodic access reviews and certifications. An agent skill from sickn33/agentic-awesome-skills.

    47k GitHub starsUsed in 2 repos~3.6k tokens
    SecurityAuto-check passed

  • Admin Access Register

    sickn33/agentic-awesome-skills

    Admin account register: system, main and backup admin, seats, plan, 2FA, shared logins and access-review dates, as CSV, SQL, JSON Schema or Notion on request.

    47k GitHub starsUsed in 1 repo~4.2k tokens
    SecurityAuto-check passed

  • Implementing Identity Verification For Zero Trust

    mukul975/Anthropic-Cybersecurity-Skills

    Implements continuous, risk-adaptive identity verification for zero trust using phishing-resistant MFA (FIDO2/WebAuthn), risk-based conditional access, and identity governance aligned with NIST SP…

    34k GitHub stars~2.4k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Performing Privileged Account Access Review

    mukul975/Anthropic-Cybersecurity-Skills

    Conducts systematic reviews of privileged accounts to validate access rights, identify excessive or stale permissions, and enforce least privilege across PAM infrastructure.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    SecurityAuto-check passed

More from cbrock84/headcount

All 178 skills in this repo

  • Agent Hierarchy

    cbrock84/headcount

    Designs orchestrator-and-subagent hierarchies for a repository — splitting agents by exclusive write surface, pairing every producer with an independent auditor, and enforcing the split with a…

    2k GitHub stars~1.2k tokensUpdated 21 days ago
    Auto-check passed

  • Access And Identity

    cbrock84/headcount

    Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process.

    2k GitHub stars~1.1k tokensUpdated 21 days ago
    Auto-check passed

  • Account Based Marketing

    cbrock84/headcount

    Concentrates marketing and sales effort on a named set of accounts rather than on volume — qualifying whether the model fits your economics at all, building the account list and the buying group…

    2k GitHub stars~1.2k tokensUpdated 21 days ago
    Auto-check passed

  • Activation

    cbrock84/headcount

    Gets new users from signup to first real value — signup flow, onboarding, time-to-value, and the early experience that determines whether someone becomes a user or a lapsed account.

    2k GitHub stars~865 tokensUpdated 21 days ago
    Auto-check passed

  • AI ML Governance

    cbrock84/headcount

    Governs models and AI systems in production — intended use, evaluation, monitoring, human oversight, documentation, and the decision to deploy or retire.

    2k GitHub stars~1k tokensUpdated 21 days ago
    Auto-check passed

  • AI Research Analyst

    cbrock84/headcount

    Produces executive-level research — market sizing, competitor mapping, trend analysis, and strategic intelligence — grounded in cited sources with the confidence in each claim made explicit.

    2k GitHub stars~916 tokensUpdated 21 days ago
    Auto-check passed

Categories

Questions about Identity Lifecycle Administration

What does Identity Lifecycle Administration do?

Executes joiner, mover and leaver processes — provisioning, group membership, access changes on role change, and complete deprovisioning. Identity Lifecycle Administration is an agent skill from cbrock84/headcount. Executes joiner, mover and leaver processes — provisioning, group membership, access changes on role change, and complete deprovisioning.

When should I use Identity Lifecycle Administration?

Identity Lifecycle Administration fits situations like: tasks that involve Access reviews and audit trails.

How do I install Identity Lifecycle Administration in Claude Code?

Run `npx skills add cbrock84/headcount --skill identity-lifecycle-administration -a claude-code`. Or copy the skill folder (plugins/it-operations/skills/identity-lifecycle-administration in cbrock84/headcount) into .claude/skills/identity-lifecycle-administration in your project. Claude Code loads it when a task matches its description.

How do I install Identity Lifecycle Administration in Codex?

Run `npx skills add cbrock84/headcount --skill identity-lifecycle-administration -a codex`. Or copy the skill folder (plugins/it-operations/skills/identity-lifecycle-administration in cbrock84/headcount) into .agents/skills/identity-lifecycle-administration in your project. Codex loads it when a task matches its description.

Can I use Identity Lifecycle Administration in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add cbrock84/headcount --skill identity-lifecycle-administration -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/identity-lifecycle-administration, .gemini/skills/identity-lifecycle-administration, .github/skills/identity-lifecycle-administration and .opencode/skills/identity-lifecycle-administration in your project.

What does Identity Lifecycle Administration need to run?

SKILL.md names no scripts, command-line tools or credentials: Identity Lifecycle Administration is instructions for the agent only.

Does Identity Lifecycle Administration access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Identity Lifecycle Administration safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Identity Lifecycle Administration use?

Identity Lifecycle Administration is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Identity Lifecycle Administration use?

About 964 tokens (SKILL.md is roughly 3.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 621 tokens, read only when the agent opens those files.

What are the alternatives to Identity Lifecycle Administration?

Skills that share tags, products or a category with Identity Lifecycle Administration: Google Cloud PAM Helper (google/skills, 21k stars), OmniRoute Audit and Policy CLI (diegosouzapw/OmniRoute, 74k stars), Access Review (sickn33/agentic-awesome-skills, 47k stars) and Admin Access Register (sickn33/agentic-awesome-skills, 47k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Identity Lifecycle Administration?

cbrock84 (a GitHub user) maintains it in cbrock84/headcount, which has 2,016 GitHub stars. The repository holds 178 skills in this directory. The repository was last updated on September 17, 2026.

Source: cbrock84/headcount on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.