A disabled user who still has records shared with them

Disabled user account still holds manually shared records.

Disabling a user revokes neither roles nor record shares, and shares have no surface in the user UI, so they survive careful offboarding. Re-enable the account and the shared records are reachable again.

Manual shares live in the principalobjectaccess table, which has no user-interface surface at all. You need a direct query against it, filtered to disabled principals. The absence of any screen is exactly why this survives offboarding that otherwise went well.

Revoke manual shares alongside role removal, or reassign the records to a team.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

• A disabled user account that still holds security roles
• A flow or workflow owned by a disabled user
• A plugin step set to run as a disabled user
• A plugin step that always runs as the same named user