Know exactly what a leaver still has access to.
Connect Okta, Google Workspace, and 1Password once. Run a dry run that surfaces apps Okta does not know about—before the last day.
82%
A 2026 survey found 82% of people who left companies under 250 employees still had some access afterward.
Okta 
Google Workspace Jin leaves Friday — what does she still have access to?Use Cases
From scattered access to clean offboarding
Surface, sweep, approve — with an audit trail for compliance
Connect your identity stack once
Link Okta, Google Workspace Admin, and 1Password. One person connects, the whole team inherits access—no per-user setup, no credentials in a doc.
Connect OktaOkta Google Workspace Jin leaves Friday — what does she still have access to?Surface the access Okta doesn't see
Personal access tokens, OAuth sessions, admin roles, integration ownership. Everything a leaver still has access to, including shadow IT.
Run dry runTracePackage it as a reusable skill
Turn the sweep into a skill any IT team member can run. Revocations require approval. Audit trail for SOC 2. Nothing to remember next time.
Create a skill
Surface all access, flag shadow IT, draft revocations—then pause for approval before any change.How it works
Three steps. No credit card required.
Connect your identity stack once
Link Okta, Google Workspace Admin, and 1Password. One person connects, the whole team inherits access.
Run the free dry run
Enter a leaver's email. See every app, token, and ownership gap—including things Okta does not know about.
Automate with approvals
Turn it into a reusable skill. Revocations require sign-off from IT or the manager before they happen.
Why Kluff
The 80% solution at 5% of the cost
Torii, BetterCloud, and similar SaaS management tools runs per employee per year or per month. A Kluff workspace is $15/user/month with no per-employee pricing—unlimited AI usage, all integrations included.
Torii, BetterCloud, and similar SaaS management tools
per employee per year or per month
Kluff
$15/user/month with no per-employee pricing
- Same core job: ex-employees still have access to apps
- Approvals before anything automatic happens
- 14-day free trial, no credit card
Frequently asked questions
Does this actually revoke access?
Not automatically. The free dry run is read-only. When you automate, every revocation requires approval before it executes.
What does "apps Okta doesn't know about" mean?
Shadow IT: personal access tokens on GitHub, admin roles in Linear, integrations someone owns in a workspace. Things not provisioned through Okta.
Is this useful for SOC 2 prep?
Yes. Auditors want evidence that access is revoked promptly. The sweep gives you a documented checklist with timestamps.
Can MSPs or fractional IT partners use this?
Yes. Kluff workspaces are multi-tenant. Each client gets their own workspace, and you can run sweeps across all of them.
Other solution packs
Each pack solves one painful job. Mix and match as your team grows.
Free Leaver Access Sweep.
Also available: AppImage / Debian / Ubuntu