A compliance officer is reviewing an agent's workflow for processing employee termination requests. The workflow includes: (1) receiving the termination request from HR, (2) disabling the employee's SSO account, (3) revoking all active OAuth tokens, (4) archiving the employee's email to a compliance mailbox, (5) removing the employee from all GitHub teams and organizations, (6) transferring repository ownership for any repos the employee owns, and (7) deleting the employee's corporate laptop MDM enrollment. Which steps in this workflow MOST require mandatory human judgment gates, and why?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Most termination actions are deterministic — disable the account, revoke the tokens, remove from teams. These are mechanical follow-throughs on a decision (termination) that a human already made. But two actions require actual judgment: who inherits those repositories, and how do you securely wipe a physical device? Those need human input, not just human authorization.
Full explanation below image
Full Explanation
The distinction between steps requiring human authorization (confirming a predetermined action) and human judgment (making a decision the agent cannot make) is critical:
Steps 1-5 (receive request, disable SSO, revoke tokens, archive email, remove from GitHub teams): These are mechanical executions of a pre-decided termination. The decision to terminate has already been made by HR. Each of these actions has a clear, deterministic execution path. They can proceed autonomously with post-execution notification.
Step 6 — Transfer repository ownership: This requires genuine judgment that the agent cannot make autonomously. Questions include: Which team or person should own each repository? Are there repositories containing sensitive IP that require a specific custodian? Are there repositories that should be archived rather than transferred? Does the repo serve an active project with a designated successor? The agent cannot determine the correct new owner without organizational context that exists only in human relationships.
Step 7 — Delete MDM enrollment: MDM unenrollment remotely wipes corporate data from the device. Coordination with IT is required to: (a) determine whether a remote wipe should be triggered (if the device is not being returned) or whether enrollment should be removed without a wipe (if the device is being returned for re-imaging), and (b) ensure the physical device chain of custody is handled. The agent cannot determine the device's physical status or return process.
Option A (steps 2 and 3) are mechanical — disabling SSO and revoking tokens are deterministic, high-speed, and easily reversible if the termination was an error. Option C (all 7 steps) over-gates the process — most steps are standard, deterministic executions that do not require judgment. Option D (step 4 only) underestimates the judgment required for steps 6 and 7.