Leavers

When someone leaves the company, they should no longer be able to sign in. Resetting their password does not close the account; it only gives the account a new password.

First, check that you have the right person. For example, suppose Ava left yesterday. Her account details show the leaving date:

seclab people ava

Look for these lines:

ava: Ava Brennan, roastery lead
  status: active (left on 2026-10-21)

To stop the account from being used, disable it. Then check that nobody is still signed in:

seclab disable ava

You should see:

Disabled ava. They can no longer log in.

seclab sessions ava

You should see:

ava is not signed in anywhere.

The account remains in Lumen's records, but it can no longer sign in. Check the full name and leaving date before doing this, especially if two employees have similar names.