Former-employee access is prevented by disablingaccounts fast, revoking sessions, and removing access across email, apps, anddevices. The controls that work are a written leaver checklist, clearownership, and verification.