Before
An administrator likely had to look up the user's issued application tokens, remove them one by one, sign the user out of active sessions, and then suspend the account. These steps depended on completing several separate administrative actions in the correct order.
How it works
- A Slack bot webhook starts the containment workflow for the configured user.
- The workflow lists the user's issued access tokens and deletes each token individually before signing the user out of all web and device sessions and resetting sign-in cookies.
- Once access and sessions have been addressed, the workflow suspends the user account.
Workflow details
- Trigger and scope: A webhook from a Slack bot starts the workflow for the configured user, initiating an account-containment sequence without requiring separate administrative actions.
- Token discovery: The workflow retrieves the access tokens that have been issued to the user by third-party applications, creating the list needed for cleanup.
- Access revocation: It iterates through each discovered token and deletes the token associated with its application, ensuring the listed third-party authorizations are handled individually.
- Session termination: After token cleanup, the workflow signs the user out of all web and device sessions and resets the user's sign-in cookies.
- Account suspension: The final stage updates the user account to suspend it, completing the containment process after existing access tokens and active sessions have been addressed.
What changed
A single webhook now initiates the full ordered containment sequence. Token discovery, per-token deletion, session termination, cookie reset, and account suspension occur automatically, replacing a multi-step administrative handoff with one workflow.
Work removed
Manually listing the user's third-party access tokens, deleting each application token, signing the user out of web and device sessions, resetting sign-in cookies, and updating the account to suspended status.
Expected outcome
The workflow removes at least five recurring administrative action types from each triggered response and provides a consistent sequence for revoking access, ending sessions, and suspending the user.
