OnboardFlow

Overview

OnboardFlow is a lightweight Identity Lifecycle Management (ILM) platform built as a Proof of Concept (PoC) to demonstrate how organizations can automate employee onboarding and offboarding using tools they already own.

The solution orchestrates:

• Slack for requests and approvals
• Airtable as the employee system of record
• Jira for auditability and task management
• Okta for identity creation and access provisioning

The goal is to eliminate manual coordination between HR, IT, Engineering, and Business teams while providing a complete audit trail and governance process.

---

Business Problem

Many organizations still onboard employees through:

• Email requests
• Slack messages
• Spreadsheets
• Manual ticket creation
• Ad-hoc approvals

This often results in:

• Delayed employee productivity
• Missing approvals
• Inconsistent access assignments
• Lack of auditability
• Increased operational overhead

OnboardFlow automates the entire process from request initiation through provisioning and governance.

---

Solution Architecture

HR / Manager
      |
      v
   Slack
      |
      v
OnboardFlow Backend
      |
      +----------------+
      |                |
      v                v
  Airtable         Jira Cloud
(Employee Data)    (Audit Trail)
      |
      v
    Okta
(User + Groups)
      |
      v
 Slack Notifications

---

Features

Employee Onboarding

• Select pending employees from Airtable
• Review employee details
• Generate Jira parent ticket
• Generate Jira child tickets for each access request
• Route access requests to appropriate owners
• Create Okta user account
• Assign Okta groups
• Update Jira tickets automatically
• Update Airtable status
• Send Slack notifications

Employee Offboarding

• Select active employees
• Review assigned access
• Remove Okta group memberships
• Deactivate Okta account
• Create Jira audit records
• Update Airtable status
• Send Slack notifications

Governance

• Approval workflow
• Access ownership model
• Audit trail through Jira
• Role-based access catalog
• Slack approval experience

---

Airtable Data Model

Employees Table

Field	Description
Full Name	Employee name
Email	Corporate email
Department	Employee department
Manager	Manager name
Start Date	Start date
Location	Work location
Access Profiles	Linked access records
Status	Pending / Approved / Active / Offboarding

Catalog Table

The Catalog table acts as a role-based access control catalog.

Each access profile contains:

• Access Name
• Owner Team
• Approval Required

Examples:

Access Profile	Owner
Google Workspace	IT
GitHub	Engineering
AWS	Engineering
Salesforce	Sales
HRIS	HR
Internal APIs	Engineering
VPN	IT

This design allows administrators to manage onboarding rules without modifying application code.

---

Workflow

Onboarding

1. HR adds employee to Airtable
2. Employee status becomes Pending
3. User runs /onboard in Slack
4. Employee is selected
5. Slack approval request is generated
6. Jira parent ticket is created
7. Jira child tickets are created per access profile
8. Okta user is created
9. Okta groups are assigned
10. Jira tickets are updated
11. Airtable status changes to Active
12. Success notification posted to Slack

Offboarding

1. User runs /offboard
2. Active employee is selected
3. Jira audit ticket created
4. Okta groups removed
5. User deactivated in Okta
6. Airtable updated
7. Slack notification posted

---

Technology Stack

Front End

• Slack Bolt SDK
• Slack Modals
• Slack Interactive Components

Backend

• Python 3.9+
• Flask
• Slack Bolt

Identity

• Okta Developer Tenant
• Okta Users API
• Okta Groups API

Ticketing

• Jira Cloud REST API

Data

• Airtable REST API

---

Project Structure

onboardflow/

├── app.py
├── config.py
├── requirements.txt
├── services/
│   ├── airtable_service.py
│   ├── jira_service.py
│   └── okta_service.py
│
├── slack_handlers/
│   ├── onboarding.py
│   └── offboarding.py
│
├── utils/
│   └── logger.py
│
└── .env

---

Environment Variables

Create a .env file:

# Slack
SLACK_BOT_TOKEN=
SLACK_APP_TOKEN=
SLACK_SIGNING_SECRET=

# Airtable
AIRTABLE_API_KEY=
AIRTABLE_BASE_ID=

# Jira
JIRA_BASE_URL=
JIRA_EMAIL=
JIRA_API_TOKEN=
JIRA_PROJECT_KEY=

# Okta
OKTA_ORG_URL=
OKTA_API_TOKEN=

---

Installation

Clone Repository

git clone https://github.com/yofti/onboardflow.git

cd onboardflow

Create Virtual Environment

python3 -m venv .venv

Activate Environment

Mac/Linux

source .venv/bin/activate

Windows

.venv\Scripts\activate

Install Dependencies

pip install -r requirements.txt

---

Run Application

python app.py

Expected startup output:

[2026-06-01 10:50:18] [STARTUP] Starting OnboardFlow in Slack Socket Mode
[2026-06-01 10:50:18] [STARTUP] Slack commands registered: /onboard, /offboard
[2026-06-01 10:50:18] [STARTUP] Onboarding workflow enabled
[2026-06-01 10:50:18] [STARTUP] Offboarding workflow enabled
[2026-06-01 10:50:18] [STARTUP] Waiting for Slack events...
⚡️ Bolt app is running!

---

Demo Scenario

This PoC was designed around a common onboarding use case:

New Employee: Sarah Chen

Requested Access:

• Google Workspace
• GitHub
• AWS
• Internal APIs

Expected Results:

• Jira onboarding record created
• Jira access tickets created
• Okta user created
• Groups assigned automatically
• Airtable updated
• Slack notifications delivered

---

Future Enhancements

• SCIM provisioning
• Manager approval workflows
• Role templates
• Access recertification
• Slack AI status summaries
• ServiceNow integration
• Workday integration
• Identity verification integration with Nametag
• Risk-based access controls

---

Key Outcomes

• Reduce onboarding effort by 70%+
• Improve employee Day-1 readiness
• Establish complete audit trail
• Standardize access provisioning
• Reduce operational burden on IT teams

---

Author

Yofti Makonnen

Sales Engineering Mock PoC

Built to demonstrate identity lifecycle orchestration using Slack, Airtable, Jira, and Okta.