The problem
When an employee changes role — promotion, transfer, contractor conversion, intern-to-FTE — their access needs to be reconciled across every connected system. Old groups removed, new groups added, Jira project permissions swapped, M365 license tier changed. Manual reconciliation across 4-6 systems takes hours per transition and routinely leaves orphaned permissions that surface as security findings months later. At cohort scale (a sales class of 12 SDRs promoting to AE on the same date, a summer intern cohort converting in September), the manual approach simply doesn't scale.
What AscendCore does
An IT admin invokes /role-change <user-email> <from-role-id> <to-role-id> from Slack (or types role-change ... in Microsoft Teams). AscendCore looks up both roles in its catalog, computes the access diff (groups to add/remove across Okta and Entra, Jira project role swaps, M365 license tier change, distribution list changes), and posts a single approval card to the IT admin channel showing every change. On approval, AscendCore applies every change and reports the outcome of each step; one record on the tamper-evident audit chain carries the per-step outcomes for SOC 2 evidence.
Commands
# Slack
/role-change <user-email> <from-role-id> <to-role-id>
# Teams (DM the bot or @mention)
role-change <user-email> <from-role-id> <to-role-id>
Examples:
/role-change sarah@acme.com support-tier-1 support-tier-2— helpdesk promotion/role-change marcus@acme.com sales-development-rep account-executive— SDR → AE with DocuSign + ZoomInfo + E5 license tier/role-change ben@acme.com engineering-contractor engineering-fte— contractor conversion with VPN + E5 unlock/role-change priya@acme.com hr-generalist hr-manager— HR promotion to payroll-admin + executive comms DL/role-change alex@acme.com intern engineering-fte— September cohort conversion
Seed role catalog
Five seed roles ship out of the box. Each role declares its access bundle: Okta and Entra security groups, Jira project roles, a Microsoft 365 license, and distribution list memberships. Org-specific role catalogs are on the roadmap.
| Category | Roles | |---|---| | Support | support-tier-1 → support-tier-2 (helpdesk promotion with elevated rights) | | Sales | sales-development-rep → account-executive (cohort onboarding with SSO app provisioning + advanced compliance license) | | Engineering | engineering-contractor → engineering-fte; intern → engineering-fte (security guardrail removal + VPN access + license tier upgrade) | | HR | hr-generalist → hr-manager (PII-elevation flow with payroll admin + executive comms DL) |
Workflow
- Invoke — admin types
/role-change <user-email> <from-role-id> <to-role-id> - Resolve — Okta lookup for the target user; refuse no-op transitions if the two roles resolve to identical access bundles
- Diff — compute groups to add/remove, Jira role swaps, M365 license change, DL changes
- Propose — single approval card with sectioned diff (only non-empty sections rendered for readability)
- Approve — IT admin clicks Approve in the configured admin channel
- Execute: AscendCore applies the access changes across Okta, Entra, Jira, and Microsoft 365, ordered so the user is not left without the access they need mid-transition
- Notify — requester DM'd by the bot with success/failure summary; result card in admin channel shows per-step outcomes
- Audit: one record on the tamper-evident audit chain carries every per-step outcome (succeeded, failed, or skipped), so a role change reads as a single approved event rather than dozens of separate group changes.
When a step fails
If one system fails partway (for example, Jira is briefly unavailable), the result card shows exactly which changes succeeded and which need follow-up, with the reason, and the audit record reflects the real end state rather than hiding it. Re-running the role change after fixing the issue is safe.
Integrations
- Okta: group membership
- Microsoft Entra ID: security group membership
- Jira / Atlassian: per-project role assignment
- Microsoft 365: license and distribution list changes
- Slack + Microsoft Teams — Admin-invoked entry point and approval surface, with full Block Kit and Adaptive Card parity
Enterprise-tier configuration roadmap (not yet wired)
- Privileged Identity Management (PIM): direct integration is on the Enterprise-tier roadmap.
- Conditional Access: the runbook never edits Conditional Access policies (one wrong change can lock everyone out); access is granted through group membership that your existing policies already reference.
- Direct SaaS app provisioning (DocuSign, ZoomInfo, and similar): handled today through Okta group membership and your existing SSO provisioning; direct integrations are on a customer-driven roadmap.
- Manager dual-approval (manager + IT admin both required) — currently single-approval (IT admin); manager-routed approval as an additive policy is on the Enterprise-tier roadmap.
Status
Live in production — orchestrator + 5 seed roles + Slack + Teams parity + per-step audit outcomes shipped May 2026.
