The replacement inherits the role. Not someone else's permissions.

Privilege creep is access accumulating beyond what a role needs. Backfills are a common source: when a replacement starts, the fastest way to provision them is to copy an existing colleague's permissions, and that colleague has usually collected extra access of their own over several years. The new person inherits all of it on day one, and nobody ever reviews it because it was never granted deliberately.

From the offboarding it replaces. When you start a replacement onboarding from a completed offboarding, PurpletGo reads the apps that were revoked from the departing employee and the equipment assigned to them in the asset register, and writes one provisioning task per real app and per real item, up to eight apps and eight items so a leaver with thirty licences does not produce a thirty-line checklist. If the offboarding carried neither, the checklist falls back to generic wording rather than inventing specifics. The offboarding-to-onboarding bridge is on the Team plan and up.

No. PurpletGo produces the checklist; a human still grants each item in the app itself. The point is that the list is derived from a record of what the role actually had, so nothing is granted by copying a colleague and nothing is missed because someone forgot an app existed.

That is the useful moment. A list of the leaver's real access, in front of the person provisioning the replacement, is the natural point to remove what the role never needed. Each task can be edited before anyone acts on it, and each one is ticked off individually with an audit entry.

Yes. The onboarding record stores the offboarding it came from, so the replacement can be traced back to the departure it fills. What the departing employee documented during their handover is carried across to the new record as read-only context, and their exit interview is deliberately not, since it is confidential.