operations-hr · agent
Shortslate
14 h/mo saved
connected$3,900One-time
Included in Growth · $990/mo
operations-hr · workflow
Keycut
Accounts and the laptop task open on day one, closed on the last day — not in a Slack thread
popular
9 h/mo
Saved
60 min
Setup
8
Systems touched
15
Credits per run
$7,900
Perpetual single-workspace license · Band 4 · System
Or included in Growth at $990/mo, along with everything else that tier carries.
- Deployment
- connected
- Setup
- 60 min
- Hours saved / month
- 9
- Included from
- Growth
- Credits per run
- 15
03 — Proof
What is measured, and what is not.
The hours and the setup time are catalog math at a stated volume. Production telemetry is not published yet, and nothing here pretends otherwise.
Catalog math
5 join/leave events/month × 90 min of accounts, laptop, and group chase, plus ~1.5h of leftover-admin hunt
Run telemetry
04 — What it does / 4 outputs
Provisions and revokes Okta groups, Workspace licenses, and asset tasks from HRIS join/leave events.
- Provisioned or revoked accounts
- asset task
- incomplete-leaver list
05 — One run
What one run takes in, and what it puts back.
No sandbox on this page yet. This is the real input and output contract from the record, not a demo recording.
In
- HRIS join/leave event
- role-to-group map
- license SKU
- asset task template
- named IT owner
Out
- Provisioned or revoked accounts
- asset task
- incomplete-leaver list
- exportable run log
06 — How it works / 60 min setup
Three steps, then it is furniture.
01
Connect Okta and Google Workspace
Scoped authorisation, revocable from your IdP or the dashboard.
02
Point it at the work
HRIS join/leave event, role-to-group map.
03
It runs
Provisioned or revoked accounts — on a trigger or a schedule, 60 minutes after you start.
07 — Features / 7 listed
What is actually in the box.
- Role-to-Okta-group and Workspace-license map you maintain; Keycut will not guess a group from the job title string
- Trigger is hired/terminated (or contractor ended) in Gusto, Rippling, or BambooHR — not a form in Slack
- Joiner: create/assign groups and license, open an asset task in Asana or Notion
- Leaver: revoke groups and license, hold “complete” until the asset task is checked in
- Will not mark complete while an Okta admin role or a Workspace super-admin is still on the person
- Does not disable payroll; Gusto/Rippling employment status stays in the HRIS
- Run log exportable: who, when, which group, success or error — not a screenshot of Okta
08 — Data
Does it fit your stack and your data?
| Input | Output |
|---|---|
| HRIS join/leave event | Provisioned or revoked accounts |
| role-to-group map | asset task |
| license SKU | incomplete-leaver list |
| asset task template | exportable run log |
| named IT owner |
09 — Integrations / 8 systems
It touches these, and nothing else.
10 — The money
Your hours, your hourly cost.
Two numbers: the hours this product removes at the catalog's stated volume, and the cost of an hour, which only you know.
9
You type this one. We do not know what an hour costs you.
Recovered per month
$450
9 h × $50 an hour, before the credits a run spends.
Where the hours come from: 5 join/leave events/month × 90 min of accounts, laptop, and group chase, plus ~1.5h of leftover-admin hunt.
11 — Pricing
Buy it outright, or get it with a plan.
One-time
$7,900
- Perpetual single-workspace license to this product’s logic, UI and connectors. Runs still spend credits.
- Returns $3,160 as non-expiring credits at your tier’s rate.
- Twelve months of updates and connector maintenance included.
Per run
15 credits
$0.30 a run at the Starter rate of $0.0200 per credit, less on every tier above it.
Credit class: light
Every run carries a published hard ceiling. A run that hits it stops and re-quotes instead of billing on.
12 — Packs / 1 pack
What else is in the pack.
Part of the Weekone pack
The first-week run for a new hire, assembled before their laptop arrives
- Fieldpull
A checklist item is only done when the DocuSign envelope is complete, and Fieldpull is what reads that completed envelope's mapped fields into the HRIS instead of someone retyping them.
- Playwrite
The day-by-day tasks come from a role template somebody has to write, and Playwrite turns a recording of the job being done into the draft SOP that template is built from.
- Askbook
Week one is when a hire asks the handbook the most questions, and Askbook answers them with the cited paragraph or an honest handoff to the HR owner.
- Holdslot
Orientation, the manager 1:1 and the buddy session all have to be booked across several calendars and logged, which is the booking-and-write-back mechanic Holdslot already runs for interview panels.
Included in Enterprise · from $7,500/mo
- Fieldpull
13 — Security
Runs on nox.markets, acts in your tools.
A scoped OAuth token pulls only the objects the inputs above require, writes the outputs back to your system of record, and keeps the run payload for your workspace retention window. Revoke the token in your IdP or in the dashboard; connector secrets are deleted within 24 hours of a disconnect.
Run payloads are kept for your workspace retention window — 30 days by default on Starter and Growth, 90 on Scale and Enterprise, with zero retention available on Enterprise.
14 — Customers
Someone like you, running this.
15 — Detail
The long version, including what it will not do.
Joiners without groups and leavers with admin are the same job: a list of systems, a ticket, and a hope. Keycut is a workflow on the HRIS event (hired / terminated in Gusto, Rippling, or BambooHR). It provisions or revokes the Okta groups and Google Workspace license you mapped for that role, files the laptop/asset task, and will not mark the person complete while a required system is still open.
It does not wipe a disk and it does not call the leasing company. It will not catch a personal Dropbox with customer files. It is not a monthly SaaS-waste audit — that is Seatcheck in `finance-backoffice`. If Okta Lifecycle Management already provisions from Rippling and IT runs a working offboarding checklist, do not pay twice. Buy it when access still starts with a Slack message to whoever remembers the admin console.
16 — Questions / 5 answered
Before you buy.
What does it need from me before it can run?
HRIS join/leave event; role-to-group map; license SKU; asset task template; named IT owner. Nothing else is collected for a run.
How long does setup take?
60 minutes. Runs on nox.markets, acts in your tools. You authorise Okta, Google Workspace, Gusto, Rippling, BambooHR, Asana, Notion, Slack once.
What does it cost to own?
$7,900 once — band 4, System. Runs still spend credits. It is also included in the Growth plan at $990/mo — buying it outright is the way to keep it after a plan ends.
What does it hand back?
Provisioned or revoked accounts; asset task; incomplete-leaver list; exportable run log.
Where does the hours-saved number come from?
5 join/leave events/month × 90 min of accounts, laptop, and group chase, plus ~1.5h of leftover-admin hunt
17 — Related / 4 products
More on the Operations & HR shelf.
18 — Collections / 1 shelves
Where it sits on a shelf.
Keycut runs 9 hours of this a month.
Or keep looking: Operations & HR · Products for this team · The whole catalog
$7,900Included in Growth · $990/mo