Skip to content
back to the vault
Specimen · new-employee-onboarding · struck v1

New Employee Onboarding

Request to set up a new hire with required accounts, hardware, and access for their first day.

Learned from
8
best-handled tickets
Hardened by
8
tickets that went wrong
Proved against
8
never seen during synthesis
Median handling
146m
across 40 tickets
A

Before it starts

1 conditions · 1 added by the critic
Precondition: HR record for the provided employee ID must exist and be retrievable before any step is executed.added by critic
B

The procedure

4 steps, in order
01Verify HR record reference and confirmed start dateHR System
02Apply the approved Financial Analyst role template to the new employeeEntitlement Management System
check before continuing

Permissions assigned must exactly match the approved role template for the job title; Verify that the employee's job title from the HR system matches the Financial Analyst role before applying the template.

03Order laptop for delivery prior to the start dateAsset Register
check before continuing

Start date has been confirmed; Verify that the laptop order is within the approved budget and has manager sign‑off before placing the order.; Require explicit confirmation (e.g., a flag or manual approval) before placing the laptop order to prevent duplicate or erroneous purchases.

04Schedule sending of login credentials to the manager on the morning of the start dateEmail
check before continuing

Manager contact confirmed; Confirm that the manager's email matches the record in the HR system and is approved for receiving credentials.

C

Stop and fetch a human when

1 mined from real failures · 1 from adversarial review
HR record does not exist or start date cannot be confirmedmined
because these went wrong:NEW-1237NEW-1238
Escalate to a human operator if any step returns an error or verification fails (e.g., entitlement assignment failure, asset order rejection, email send failure).critic
D

What the critic caught

raised against the draft, before this was struck
highThe skill applies the Financial Analyst role template without verifying that the new hire's actual job title matches that role, allowing inappropriate privilege escalation.

A new hire for a non‑financial position (e.g., Marketing) is onboarded and the skill automatically grants Financial Analyst permissions, giving the employee access to sensitive financial systems.

Verify that the employee's job title from the HR system matches the Financial Analyst role before applying the template.

highNo verification that the HR record actually exists before proceeding, despite the escalation rule only covering missing records after the fact.

A request is submitted with a mistyped employee ID; the skill proceeds to order hardware and assign permissions using a non‑existent HR record, creating orphaned accounts.

Precondition: HR record for the provided employee ID must exist and be retrievable before any step is executed.

mediumThe laptop order step lacks budget or approval verification, potentially causing unauthorized purchases.

An attacker submits a fake onboarding request for a large number of expensive laptops; the skill orders them without checking departmental budget limits or manager approval.

Verify that the laptop order is within the approved budget and has manager sign‑off before placing the order.

mediumThe credential‑sending step does not confirm the manager's identity or email address, risking credential leakage to the wrong recipient.

A malicious actor provides a fabricated manager email; the skill sends login credentials to that address, compromising the new employee's accounts.

Confirm that the manager's email matches the record in the HR system and is approved for receiving credentials.

lowThe escalation rule only covers missing HR records or unconfirmed start dates; it does not handle failures in entitlement assignment, asset ordering, or email dispatch.

The Entitlement Management System returns an error when applying the role template; the skill continues and reports success, leaving the employee without proper access.

Escalate to a human operator if any step returns an error or verification fails (e.g., entitlement assignment failure, asset order rejection, email send failure).

lowNo irreversible action confirmation before ordering hardware; the skill cannot be cancelled once the order is placed.

A duplicate onboarding request is processed, causing two identical laptop orders to be placed before anyone notices.

Require explicit confirmation (e.g., a flag or manual approval) before placing the laptop order to prevent duplicate or erroneous purchases.

E

Tools it needs

declared up front, not discovered at runtime
HR SystemEntitlement Management SystemAsset RegisterEmail