Token Vault + CIBA

Onboarding
on autopilot.

Day two. Still waiting on access. Done.

A multi-agent AI system that provisions every new hire across GitHub, Slack, Gmail and Google Calendar in under two minutes — with scoped credentials, human-in-the-loop approvals, and a complete audit trail.

Start onboarding How it works

GitHub Slack Gmail Calendar Token Vault CIBA

The workflow

One form. Four agents. Zero manual steps.

Submit a new hire form and watch a LangGraph-orchestrated pipeline provision every platform in parallel.

Submit new hire

HR fills in name, role, team, GitHub username, and Slack channels. Optionally flags production access.

Agents spin up

LangGraph launches 4 parallel agents. Each requests a scoped token from Auth0 Token Vault before acting.

AI reasons first

GPT-4o-mini analyses the new hire's role and team, then plans what to do before calling any API.

Provisioned + audited

Every action is logged with timestamp, token scope, and agent decision. Human approval gates production.

The agents

Four agents, one pipeline.

Each agent is autonomous, reasoned by GPT-4o-mini, and operates only with the minimum scopes required.

GitHub Agent

read:user · repo · admin:org

Looks up the new hire's GitHub user ID
Sends an organisation invitation as direct_member
Grants repository-level collaborator access
GPT-4o-mini reasons about which repos fit the role

Org invite and repo grants are independent — a failed invite never blocks repo access.

Slack Agent

chat:write · users:read · channels:read

Resolves email → Slack user ID via users.lookupByEmail
Lists all public channels to match configured names
Invites user to each channel by ID (not email)
GPT-4o-mini decides the best channels for the role

Channel invites use the Slack user ID — never the email address — avoiding API rejections.

Gmail Agent

gmail.send

GPT-4o-mini writes a personalised HTML welcome email
Email references the new hire's exact role, team, and repos
Falls back to a handcrafted template if LLM is unavailable
Sent via the gmail.users.messages.send API

The email body is AI-generated per new hire — not a generic template.

Calendar Agent

calendar.events

GPT-4o-mini generates 3 role-specific onboarding meetings as JSON
Day 1: Welcome 1:1, Day 2: Team intro, Day 3: Systems check-in
Meeting titles and descriptions tailored to role and team
Events inserted with sendUpdates: all so the new hire gets invites

Meeting content is GPT-4o-mini-generated — personalised to title, team, and GitHub repos.

Security

Designed around least privilege.

Every credential is scoped, short-lived, and logged. Sensitive actions require explicit human sign-off.

Auth0 Token Vault

Agents never see long-lived credentials
Short-lived scoped access tokens, issued per action
Token is never stored — requested, used, discarded
Backed by Auth0's secure token storage layer

CIBA — Human Approval

Production access requires out-of-band authorisation
Push notification sent to manager's Auth0 Guardian app
Agent pauses in awaiting_ciba state
Cannot proceed without explicit human approval

Full Audit Trail

Every token issued logged with scope + timestamp
Every API call recorded with platform + action
AI reasoning steps stored (🤖 prefixed entries)
Immutable per-job log, always visible in the UI

Credential resolution chain

1. Auth0 Token Vault2. Env-var fallback (PAT / Bot token / OAuth refresh)3. Agent reports not configured

Token Vault is always attempted first. If not configured, agents fall back to securely stored environment credentials. Accounts status is visible on the Accounts page.

Stack

Built on production-grade infrastructure.

Next.js 16

App Router + Server Components

Auth0 v4

Token Vault · CIBA · Sessions

LangGraph

Multi-agent orchestration graph

GPT-4o-mini

Per-agent AI reasoning + generation

Octokit REST

GitHub API — orgs, repos, users

Slack SDK

@slack/web-api — channels, users

Google APIs

Gmail v1 · Calendar v3

TypeScript

End-to-end type safety

Get started

Onboardingon autopilot.