Taking access away is more dangerous than granting it. Grant the wrong person a license and you waste some money. Revoke the wrong person and you break someone's work in the middle of their day. So the Separation Engine is built as a layered defense with a deliberate bias: when it is not sure, it does not revoke.
When someone leaves the university, their paid software should be reclaimed, both to stop paying for it and to free the seat for someone else. But "leaving" is a fuzzy word. People go on leave and come back. They transfer between departments. They retire into emeritus status and keep teaching. They get rehired a week later. They are students who are also employees. An HR feed that stamps someone "inactive" is often wrong, or only temporarily right.
A system that revoked on any "inactive" signal would constantly cut off people who should keep their tools: the emeritus professor, the staff member mid-transfer, the rehire. And a system that simply trusted the upstream feed would silently miss the people it fails to flag. Neither is acceptable.
So License Commander runs a layered defense: several independent checks, each catching what the others miss, each biased toward not wrongly revoking. And when a bad revocation does slip through, the Engine notices and undoes it.
By the numbers
independent layers a departing employee passes through, each catching what the others miss.
emeritus faculty the Engine will ever revoke. A status flicker never costs a retired professor their tools.
active license holders re-checked in a single weekly safety-net pass.
only. A seat counts as reclaimed when the vendor confirms the removal, never on a hopeful assumption.
a wrong revocation is caught and undone, not left to fester as a silent outage.
of warning a former student gets, with a chance to save their designs, before their UCI Canva seat is removed.
The daily reclaim
A list of who to reclaim, removed at the vendor, and only marked done when the vendor says so.
Every day the Engine works a list of holders who should lose access, and reclaims each seat at its vendor using the same adapters that grant it, an Adobe group removal, an Entra group removal, a Canva team removal. The record is marked revoked in License Commander, and billing stops. It is the routine, high-volume backbone of separation.
Why it is clever
A seat is marked reclaimed only when the vendor confirms the removal. If a vendor call is not confirmed, the record gets no marker and the next day's run simply tries again, so a dropped API call never leaves a phantom "done." And one rule protects everyone: a shared-device license is never treated as a person. The name on a lab-machine license is only the responsible contact, so reclaiming that machine can never accidentally cut off a real employee's own access.
Since October a second rule sits in front of every removal: nobody is taken out of an Adobe or Microsoft group while they still hold another active seat for that product. Group membership belongs to the person, not the record, so reclaiming an old or duplicate record could otherwise take away a license they are still using. If the Engine cannot complete that check, it keeps their access. A missed removal costs a seat for a day; a wrong one locks out someone who is still entitled to it. It also never stamps a removal marker on a live seat, so the record and the vendor tell the same story.
✓ Toil removed manually removing each departing person from every vendor console, and never being sure it actually took.
The gate at the door
Before granting a new license, catch the person who is already on their way out.
Separation is not only about reclaiming what exists; it is also about not handing out something new to someone who is leaving. So at the moment an order is approved, the Engine checks the requester's HR status. If they read as separated, it stops and warns the approver before a paid seat is granted. This runs on every approval path, no matter who is doing the approving.
Why it is clever
It warns and asks for an override rather than hard-blocking, because the grant is sometimes legitimate, a rehire whose paperwork has not caught up, or emeritus faculty who genuinely need the tool. The judgment stays with the human, but the risk is put in front of them in plain language, so nobody discovers "wait, this person already left" only after the money is spent.
✓ Toil removed granting a license to someone who has already separated, and finding out at the next recharge.
The weekly safety net
A second pass that assumes both the daily job and the upstream feed can be wrong.
Once a week the Engine re-scans every active license holder, thousands of them, and surfaces two very different problems. First, revocations the upstream asked for that never actually applied, the record is still active with no removal marker, which is a genuine miss to fix. Second, active holders who match a separation rule that the upstream never flagged at all. It reports both, and never changes anything on its own.
Why it is clever
It grades its own confidence and keeps the two cases strictly apart. "Failed to apply" is high-confidence: the system was told to remove these and it did not, so fix them. "Matched a rule" is lower-confidence and may include people on leave or mid-transfer, so review before acting. It even reconciles the count, listing the people it deliberately did not revoke because they have since recovered, so the numbers add up and nothing hides.
✓ Toil removed assuming the daily job caught everything, and discovering months later that it quietly did not.
When a student graduates
The departure an HR feed rarely reports, because most students were never on payroll.
Students who graduate or stop enrolling keep whatever license their department bought for them, and the HR feed has no reason to flag them, since most were never employees. So a quarterly check, run about three weeks into fall, winter, and spring, looks for live seats whose holder is not an employee and whose last enrolled quarter is behind the current one. It skips summer, when plenty of continuing students simply are not enrolled, and it leaves shared-device and site licenses alone.
Why it is clever
The seat goes back to the department, not to the vendor. A reclaimed student seat becomes a paid spare in the department's own pool, with its billing kept and its vendor access removed, so the department can hand it to the next student without buying another. There is no refund and no email to anyone. The check only reports; a person reviews the list before anything is reclaimed. The first review, in October, checked every name against the live campus directory before a single seat moved.
✓ Toil removed a graduate's paid seat sitting unused for years while the department buys a new one for the next student.
A heads-up before Canva access ends
Former students get a warning and a week to save their work.
Campus sign-on sends anyone without active student data to the Canva-Employees team, so a former student who signs in with their UCI account lands on a paid seat. Every four hours a job on a campus machine checks the live campus directory and takes those seats back. Since October 15, nobody is removed without warning. The first time someone qualifies, they get one email: UCI Canva is for current students and employees, here is how to save your designs and keep going with a personal Canva account, and reply if you work at UCI or have re-enrolled. The seat is removed seven days later. The job now also covers former students who never had a License Commander record, as long as the live directory does not list them as an employee, staff member, or faculty member.
Why it is clever
It is cautious in the same ways as the rest of the Engine. If the campus directory cannot be reached, nobody is removed that run. Anyone the live directory lists as an employee, staff member, or faculty member is left alone, and so are shared accounts and anyone with a paid Canva order. A run that would touch more than 40 people stops and asks a person instead. Someone who signs back in after their notice is removed quietly, because they have already been told, and each notice goes out only once.
✓ Toil removed former students quietly holding paid Canva seats, and people losing their designs with no warning.
When it is not sure, it does not revoke. Cutting off the wrong person is the expensive mistake, so the Engine is built to make the cheap one instead.
Knowing who never to touch
A short list of people and seats that are never a revoke target, no matter what a feed says.
The Engine carries hard rules about who is protected. Emeritus faculty are a valid path back to active and are never revoked. Shared-device licenses are not people. And a paid pool seat, one the unit already funded for the current fiscal year, is left in place as a transferable asset rather than clawed back. These rules sit ahead of every revocation decision.
Why it is clever
Emeritus faculty routinely flip to "inactive" in the HR feed and back again. The Engine recognizes the emeritus classification and treats that flicker as a non-signal, so a retiring professor never loses their software the week their status wobbles. It is the difference between an automation people trust and one they learn to fear.
✓ Toil removed the angry call from a professor whose software vanished because an upstream feed blipped for a day.
Undoing a wrong call
When a bad revocation slips through, the Engine catches it, and reinstatement stays honest.
Even with all of that, a wrong revocation occasionally gets through, usually when the upstream flips someone's status and the daily job acts before their return is visible. So the Engine watches for recovery. When a revoked person turns out to be active or emeritus again, it treats the past revocation as moot. And when a genuine reinstatement comes through, it refuses to silently restore a seat nobody paid for.
Why it is clever
Reinstatement is gated by a paid-fiscal-year check. Coming back does not automatically un-revoke a paid license; if the unit has not funded it for the current year, the "reinstatement" becomes a fresh pending order that has to be approved and paid for, not a free seat handed out by a status flip. So the two failure modes are closed at once: nobody is wrongly cut off, and nobody is quietly given a license the books never accounted for.
Before any bulk removal, the Engine also holds back a revoke with no story behind it. When a currently active person's seat reads as revoked but nothing in the history shows anyone deciding to revoke it, the seat is flagged for review instead of removed, because that pattern usually means a feed blip, not a choice. In October that rule learned to recognize two more deliberate revokes: a revoke made in a bulk edit, and a seat given away in a transfer. Before, both looked suspicious, so seats a unit had let go of on purpose were held back, and an earlier cleanup had even restored some of them. Now a unit's decision is honored the same way a single revoke is.
✓ Toil removed hand-undoing false revocations, and the opposite error of silently regranting free licenses whenever a feed flips someone back on.
A reclaim you can trust, because it is careful
Several independent checks, a deliberate bias toward never wrongly cutting someone off, protections for the people a feed gets wrong, a careful path for the graduates and former students an HR feed never mentions, and the reflex to undo its own mistakes. Access is reclaimed when it should be, billing stops when it should, the books stay honest, and the person who should keep working never loses their tools to a bad signal. Separation, done carefully enough to trust.