Their employee left. Can they still act through the business account you verified?

When a company representative leaves or changes role, review what they can still do through your platform. Their identity check may remain accurate while their authority to issue instructions has ended.

An illustrative gap is a former employee whose login still works because only the company's email directory was updated. Your business account, support approvals and integrations may each hold separate permissions.

Confirm the reported authority change

Record who reported it, when it takes effect and which legal entity and representative it concerns. Confirm the instruction through an established authorised company route.

Do not hand control to whoever reports the departure. If authority is disputed, follow a documented escalation process and decide how sensitive actions will be handled while the evidence is unresolved.

Toden's KYB-applicant guide explains why identifying a person and establishing representation are separate checks. The distinction still matters after onboarding.

Find every route the person could use

Review interactive access, active sessions, invitation rights, support authorisations and any delegated credentials under the person's control. Include authority to change payout instructions or add another operator.

List each access path with its owner and the action needed. Removing a visible team row is incomplete if another route still permits the same sensitive instruction.

Where a shared credential was accessible to the departing person, assess rotation and dependent services deliberately. Avoid breaking a production integration without an owner and recovery plan.

Enforce the revised authority on the server

OWASP's authorisation guidance (opens in a new tab) calls for permission checks on every request. A cached role or old browser session should not override the current business-account policy.

Review pending sensitive requests created before the change. Decide whether they remain valid or need confirmation from a currently authorised representative. Record the decision rather than assuming that an old request is automatically cancelled or still approved.

Keep the company's identity record intact unless there is a separate reason to review it. A departing representative and a change of company ownership are different events.

Verify closure and the replacement route

Test that the removed authority cannot perform the affected actions. Record when each route was closed and who confirmed it. Establish the replacement representative's identity and authority before granting the corresponding access.

Review Toden's business-verification capabilities alongside your application's own permissions. Bring one representative-departure scenario to the review: the goal is to prove who may act now, not merely who passed a check in the past.