Your HRISYour HRIS already knows who works there.Everything else should, too.

policy "Logistics core access" {

  category = "onboarding"

  applies  = segment.logistics

  stage active {

    target microsoft_entra.user {

      displayName    = worker.display_name

      accountEnabled = true

      usageLocation  = "US"

      jobTitle       = lookup(table.titles, worker.job.code)

      licenses = each worker.assignments as a

        where a.is_primary {

          skuId = lookup(table.skus, a.job.code)

        }

    }

    target oracle_fusion.worker {

      firstName    = worker.legal_name.given

      lastName     = worker.legal_name.family

      jobCode      = worker.job.code

      locationCode = lookup(table.sites, worker.location.code)

    }

    target slack.user {

      userName    = worker.business_email

      displayName = worker.display_name

      givenName   = worker.legal_name.given

      familyName  = worker.legal_name.family

      title       = lookup(table.titles, worker.job.code)

      channels    = ["C07LOGISTIC", "C02GENERAL"]

    }

    notify email "First day" {

      send    = once

      subject = "Your first day"

      body    = "Your first sign-in: {{ microsoft_entra.sign_in_url }}"

      to      = [worker.personal_email, manager(1)]

    }

    notify slack "IT alerts" {

      send    = once

      webhook = secret.it_alerts

      text    = "Logistics access provisioned."

    }

  }

  stage terminated {

    target microsoft_entra.user {

      accountEnabled = false

      licenses       = []

    }

    target oracle_fusion.worker {

      assignmentStatusType = "INACTIVE"

      terminationDate      = worker.end_date

    }

    target slack.user {

      active   = false

      channels = []

    }

  }

}