Employee Onboarding and Offboarding Task Force�Security Enhancement Requests

College-led Process Alignment Task Force for Employee Onboarding & Offboarding (EO&O) 

�Presented to ctcLink College Collaboration Group (cCCG) �July 22, 2026

EO&O Agenda for each ER

Background

Proposal

Benefits

Background�SEC A.2.1 Onboarding Roles

3

The process of adding the ZZ Employee and District roles is currently a templatized process that runs on the new employee's official start date (first day of employment). Employees must wait for these roles to be added on their first day before they can access ctcLink.

Employees transitioning from another college have their previous roles removed during offboarding, but the templatized process does not automatically assign the ZZ Employee and District roles at their new institution. These roles must instead be added manually, creating the risk of delays and inconsistent access. Moving to a dynamic process would solve this issue.

Returning or transferring employees may have the District role but not the ZZ Employee role, preventing access until the missing role is manually assigned.

Faculty are particularly impacted because their official start date is often the first day of the academic term. Until then, they do not receive the ZZ Employee role, preventing security roles from being assigned. Faculty transferring from another college may also be missing the District role until their first day. This limits their ability to access contracts, class rosters, and other pre-term resources.

Proposal�SEC A.2.1 Onboarding Roles

Global Configuration Enhancement Request

Move the following five roles to dynamic, instead of using the templatized/App Engine.

Add these five roles as of the Action Date (data entry date) for new jobs at a new institution.

1. ZZ PeopleSoft User – Basic access to general PeopleSoft functions granted to all active ctcLink users.
2. ZZ_EMPLOYEE – Access to the HCM Self Service and Finance Self Service links in Portal (Gateway).
3. ZZ Staff Training – Syncs to Portal and Okta and used to authenticate into the Staff Training Application.
4. ZZ_OKTA_MFA – Syncs to Portal and Okta requiring MFA to be enabled for the user. Should remain on all users in the system at all times.
5. CTC_XXX_DISTR – College specific tile roles; assigns if person has Institution set to that college.

Benefits�SEC A.2.1 Onboarding Roles

• The process of adding the ZZ Employee and District role is set up to Dynamically add the needed roles for new employees at an institution, including employees transitioning from another college. Employees do not have to wait for the DIST role to be added on their first day.
• Employees transitioning from another will college receive the appropriate onboarding roles automatically, eliminating manual entry and reducing the risk of missing access.
• Faculty will receive their onboarding roles as soon as their job data is entered, allowing them to access their contracts, class rosters, and other resources before the term starts.
• Automating role assignment creates a more consistent onboarding experience, reduces support requests, and ensures employees have timely access to ctcLink.

Background�SEC A.2.2 Termination Roles

If the "Onboarding Roles" Enhancement Request is approved, this recommendation is approved by proxy.

If an employee is being offboarded, we need their roles removed so they are no longer able to access ctcLink as an employee.

Currently a Local Security Administrator must manually remove the ZZ PeopleSoft User role.

An offboarded employee will still be able to view their HCM information if these roles are removed.

Proposal�SEC A.2.2 Termination Roles

Global Configuration Enhancement Request​

The following three roles should be dynamically removed when an employee is inactive in the HCM Pillar:​

• ZZ PeopleSoft User – Basic access to general PeopleSoft functions granted to all active ctcLink users.​
• ZZ_EMPLOYEE – Grants access to the HCM Self Service and Finance Self Service links in Portal (Gateway).​
• ZZ Staff Training – Syncs to Portal and Okta and used to authenticate into the Staff Training Application.​

Benefits�SEC A.2.2 Termination Roles

• Employee access is automatically removed during offboarding, ensuring former employees can no longer access ctcLink as an employee.
• Eliminates the need for Local Security Administrators to manually remove the ZZ PeopleSoft User role, reducing administrative effort and the risk of missed offboarding steps.
• Strengthens security by ensuring employee access is revoked consistently and in a timely manner, reducing the risk of unauthorized access.
• Applies a standardized offboarding process across all institutions.
• Removing these roles revokes access to ctcLink employee functionality while allowing former employees to continue accessing their HCM self-service information, such as pay statements and tax documents, through the ZZ Former Employee role.

Background�SEC B.2.1 Launchpad off of Action Date

Currently, the Launchpad utility restricts the mass-copying of roles and the application of role templates until an employee’s Active Start Date (official first day of employment). This creates an administrative bottleneck, preventing schools from completing technical onboarding (provisioning systems, setting up permissions) before the employee arrives on-site.

Schools using templates cannot use Launchpad to apply a template until after the first day the employee starts.

Proposal�SEC B.2.1 Launchpad off of Action Date 

Global Configuration Enhancement Request

Update the system logic to allow security role assignments based on the Action Date (data entry date), rather than the Active Start Date (first day of employment), enabling use of Launchpad as of the Action Date to allow for earlier onboarding.

Benefits�SEC B.2.1 Launchpad off of Action Date 

• Launchpad can be used as of the employee’s Action Date, allowing Local Security Administrators to complete technical onboarding activities earlier, including mass-copying roles, applying role templates, provisioning systems, and setting up permissions prior to the employee’s first day.
• Institutions using security templates can apply role templates as soon as an employee is added to ctcLink, ensuring employees have the appropriate access ready when needed.
• Reduces delays caused by waiting for the employee’s Active Start Date and improves the overall onboarding experience for employees and administrators.

Background�SEC E.1.1 Delegation to ZZ HCM Manager

When a manager is hired, they receive the ZZ HCM Manager role; however, the associated delegation actions are not automatically assigned. A Local Security Administrator must manually add eight delegation action items before the manager can fully utilize manager functionality.

If these actions are not added in a timely manner, the manager is unable to delegate responsibilities to another manager, potentially delaying business processes and approvals.

When a manager leaves a college and an interim manager is assigned, the interim must also have the same delegation actions manually added. This creates a significant administrative burden for Local Security Administrators.

Proposal�SEC E.1.1 Delegation to ZZ HCM Manager

Recommendation – Global Configuration Enhancement Request

Link all HCM delegation transactions to the Current Manager role rather than using individual delivered roles to reduce configuration complexity.

Tie the following eight Delegation Actions to the ZZ HCM Manager role so managers receive all roles at once.

1. Delegate Manage Overtime Req
2. Delegate Manager Abs Bal Fluid
3. Delegate Manager Absence Bal
4. Delegate Manager Absence Rqst
5. Delegate Manager Abs Req Fluid
6. Delegate Manage Report Time
7. Delegate Mgr Abs Hist Fluid
8. Delegate Mgr Cancel Abs Fluid

Benefits �SEC E.1.1 Delegation to ZZ HCM Manager 

• Manager delegation actions are automatically assigned with the ZZ HCM Manager role, eliminating manual security updates by Local Security Administrators.
• New and interim managers have the required functionality available immediately, allowing them to delegate responsibilities and complete manager tasks without delays.
• Reduces administrative effort and configuration complexity.
• Improves consistency by ensuring all managers receive the same required security access.
• Decreases the risk of missed delegation assignments and supports timely business process approvals.

Background �SEC E.1.2 ZZ Interested Party role in TAM

For colleges using TAM (Talent Acquisition Manager), the ZZ Interested Party role must currently be assigned manually to users who need access to view job openings assigned to them.

This requires Local Security Administrators to determine who needs the role and complete individual role assignments, creating additional administrative effort and ongoing maintenance.

Because the role is not automatically assigned, there is a risk of delays when users need access to participate in recruitment activities or view assigned job openings.

Proposal�SEC E.1.2 ZZ Interested Party role in TAM 

Recommendation – Global Configuration Enhancement Request

For colleges that use TAM:

For all employees, dynamically apply the ZZ Interested Party role for TAM. This simplifies the process while maintaining security, as users only see job openings specifically assigned to them.

Benefits�SEC E.1.2 ZZ Interested Party role in TAM 

• The ZZ Interested Party role is dynamically assigned to all employees, eliminating the need for manual role requests and individual security updates.
• Simplifies security administration by reducing role assignment decisions and ongoing maintenance while still maintaining appropriate access controls.
• Employees only see job openings specifically assigned to them, ensuring security is maintained through TAM configuration while allowing broader role assignment.
• Provides a more consistent and scalable process for colleges using TAM by reducing administrative effort and improving timely access to recruitment activities.

Background �SEC H.1.1 Budget Manager Roles

Department Managers are assigned within the FSCM pillar by a budget employee; however, the system does not automatically grant the corresponding approval roles needed to perform manager responsibilities.

Local Security Administrators must manually assign approval roles for expenses, purchasing, and requisitions after a manager is assigned.

Manual role assignment requires additional communication and administrative effort and may not be completed in a timely manner, resulting in delays for new Department Managers who need to approve financial transactions.

Proposal �SEC H.1.1 Budget Manager Roles

Recommendation – Global Configuration Enhancement Request

Dynamically add Budget Manager roles when a budget manager is assigned to a department in budget (Design Chartfields method).

Shift toward dynamic assignment for Department Managers in the Budget module (e.g., expenses, purchasing, and requisition approvals) using a global query to streamline access.

Benefits�SEC H.1.1 Budget Manager Roles 

• The system is set up so that dynamic assignment for Department Managers in the Budget module (e.g., expenses, purchasing, and requisition approvals) use a global query to streamline access.
• By using a global query to identify Department Managers (MPL IDs), the system can automatically grant relevant approval roles for expenses, purchasing, and requisitions.
• This removes the need for manual security requests and manual data entry every time a budget manager is assigned to a new department.
• Dynamic assignment ensures that as soon as a manager is hired and assigned to a department in the budget module, their functional security is ready for use.

Background�SEC H.1.2 Grant PI Budget Manager Role

Individuals assigned as Project Managers or Principal Investigators on grants in ctcLink through Project Costing > Project Definitions > Manage Project Team, do not automatically receive the corresponding FSCM approval roles needed to manage grant-related financial activities.

Local Security Administrators must manually assign multiple required FSCM approval roles.

Manual assignment creates additional administrative effort and may delay a Project Manager’s ability to approve financial transactions associated with their grant responsibilities.

When a Project Manager or Principal Investigator leaves the institution, approval roles may remain active if the individual is not removed from the appropriate department or security configuration, creating a risk of retaining unnecessary access.

Proposal�SEC H.1.2 Grant PI Budget Manager Role 

Recommendation – Global Configuration Enhancement Request

When an employee is assigned as a Project Manager or Principal Investigator on a Grant in ctcLink via this navigation: Project Costing > Project Definitions > Manage Project Team, the following four Budget Manager roles should be dynamically added.

These four roles should also be dynamically removed when the ZZ Former Employee role is added at offboarding (if budget office has not removed from department table).

1. ZZ REQUISITION APPROVAL
2. ZZ VOUCHER APPROVAL
3. ZZ PURCHASING APPROVAL
4. ZZ EXPENSE APPROVAL

Additional configuration (e.g., user preferences, buyer/requester setup) may be required.

Benefits �SEC H.1.2 Grant PI Budget Manager Role

• Project Managers and Principal Investigators automatically receive the appropriate FSCM approval roles when assigned to a grant, ensuring they have timely access to complete required financial approvals.
• Approval roles are automatically removed when grant responsibilities end or during offboarding, reducing the risk of former employees retaining unnecessary financial access.
• Eliminates manual security updates by Local Security Administrators, reducing administrative effort and improving consistency of role assignment.
• Aligns security access with assigned responsibilities in ctcLink, supporting the principle of least privilege by granting access only when an individual has an active Project Manager or Principal Investigator assignment.
• Creates a more scalable and maintainable process by dynamically managing grant-related approval access rather than relying on manual updates.

Background�SEC B.4.1 LSA Notification

If the Enhancement Requests for Grant PI Budget Manager and Budget Manager are approved, the Local Security Administrators will need to be notified so they are able to complete set up in User Profile Definition (UPD) and SACR.

Without being notified, the Local Security Administrator will not know to add UPD or SACR, creating a risk that required configuration steps are missed.

Without the additional setup, employees may have the appropriate security roles but still be unable to complete required ctcLink business processes.

Proposal �SEC B.4.1 LSA Notification

Recommendation – Global Configuration Enhancement Request

When an employee receives security roles that are dynamically added for the following two roles, use Notification Composer to notify the college LSAs of the addition, so they can set up User Profile Definition (UPD) and SACR appropriately.

1. Grant PI budget Manager
2. Budget Manager

Benefits�SEC B.4.1 LSA Notification

• Local Security Administrators receive timely notifications when Grant PI Budget Manager or Budget Manager roles are dynamically assigned, allowing them to complete the necessary UPD and SACR setup.
• Provides a more complete onboarding process by ensuring security roles and related functional configuration are both addressed.
• Reduces delays and troubleshooting by proactively identifying when additional setup is required.
• Improves consistency across institutions by creating a standardized notification process instead of relying on manual communication or awareness of role changes.
• Supports successful adoption of dynamic security assignment by ensuring downstream configuration steps are completed.

Background�SEC H.1.3 Manager Role, Dynamic

Supervisor relationships are maintained in Job Data and employee assignments are maintained on the Expense Approver Assignment page; however, the related security roles needed to perform supervisor expense activities are not automatically assigned.

Local Security Administrators must manually add the required roles for supervisors.

Manual role assignment creates additional administrative effort and may delay a supervisor’s ability to delegate responsibilities or access expense-related information.

The existing custom process already identifies supervisor relationships, creating an opportunity to leverage this information for dynamic security role assignment.

Proposal �SEC H.1.3 Manager Role, Dynamic

Recommendation – Global Configuration Enhancement Request

Modify the existing custom process that reads Supervisor ID in Job Data and EMPLIDs on the Expense Approver Assignment page to dynamically add the following two roles for employees identified as supervisors.

1. ZZ Delegation
2. ZD Expenses Inquiry

Benefits �SEC H.1.3 Manager Role, Dynamic

• Supervisors automatically receive the required expense and delegation roles based on existing supervisor assignments, ensuring timely access to perform their responsibilities.
• Eliminates manual security updates by Local Security Administrators, reducing administrative effort and the risk of missed role assignments.
• Improves consistency by aligning security access with existing supervisor and expense approver assignments already maintained in ctcLink.
• Simplifies ongoing security maintenance by leveraging existing system data to dynamically manage access rather than relying on manual updates.
• Supports a more scalable approach to security administration by extending the existing custom process to automate role assignment.

Background �SEC H.1.4 Expense Approvals

Employees assigned the Expense Approval role require additional access to effectively manage approval responsibilities, including the ability to delegate approvals when unavailable and view expense information.

Currently, the related roles (ZZ Delegation and ZZ Expenses Inquiry) are not automatically assigned with the Expense Approval role, requiring additional manual security updates.

Without these roles, supervisors may be unable to set up delegation or access necessary expense information, creating delays when approval responsibilities need to be transferred.

Local Security Administrators must manually identify users with Expense Approval access and assign the additional roles, increasing administrative effort and the potential for inconsistent access.

Proposal�SEC H.1.4 Expense Approvals 

Recommendation – Global Configuration Enhancement Request

Dynamically add the following two roles to anyone with the Expense Approval role.

1. ZZ Delegation
2. ZZ Expenses Inquiry

Benefits�SEC H.1.4 Expense Approvals 

• Employees with the Expense Approval role automatically receive the related ZZ Delegation and ZZ Expenses Inquiry roles, ensuring they have the access needed to perform approval responsibilities.
• Allows supervisors to easily delegate travel and expense approvals when they are unavailable, supporting continuity of business processes.
• Eliminates manual security updates by Local Security Administrators, reducing administrative effort and the risk of missed role assignments.
• Creates a more consistent and maintainable security model by aligning related roles and automating access based on existing approval responsibilities.
• Improves operational efficiency by ensuring approvers have the necessary tools to manage expense workflows without additional security requests.

ER Questions?