Onboard a new employee — accounts, keys, first week

When to use

A contract has been signed and the person starts within days. Not for writing the contract itself — use people.employment-contract-lv. Not for contractors — use people.hire-contractor, which has no VID employee declaration. The mirror of this playbook is people.offboard-employee: everything granted here must be revocable there.

Before you start

• The contract is signed and stored (documents module); the start date is fixed.
• The manager has named the systems the role needs — not a default "everything" list.
• The company's VID electronic-declaration access works (EDS / declare dashboard, ⚠ verify current

What a run requires2

The trail9 steps

1. S1

   Open the onboarding recordagent

   Create the record: name, personal code, bank account, start date, role, manager, equipment needed, systems needed.

   Done when the record exists and every field is filled from the contract, not from memory.

   ⛔ A personal code copied by hand is the classic error — read it back from the signed contract.

2. S2

   Approve the access set and equipmentownerneeds approval · owner

   Approval · S2 · owner — the run stops until a named person records the decision

   Show the systems list, the equipment list and the cost.

   Done when the owner has approved both lists as they stand, or named the changes.

3. S3

   File the VID declaration (Latvia)agentneeds approval · owner

   Approval · S3 · owner — the run stops until a named person records the decision

   Submit the employee's data to VID through the employer's electronic declaration before the first working day (⚠ verify exact deadline and form on vid.gov.lv).

   Done when VID shows the declaration as accepted for this employee and start date.

   ⛔ Filing with a wrong personal code is worse than filing late — check it against the contract first.

4. S4

   Create the mailboxagent

   Create the mailbox in the mail module under the company domain, following tech.create-mailbox; set a first password from the paroles rules and prepare the handoff.

   Done when a test message sent to the address arrives in the new mailbox.

5. S5

   Grant access to the approved systemsagent

   Create the account in each system approved in S2, record the credential per the paroles module rules (individual passwords, no sharing), and note each grant in the onboarding record.

   Done when every approved system lists the new account and no system outside the list does.

6. S6

   Prepare equipment and workplaceagent

   Laptop imaged and enrolled, keys or badge issued, desk ready. Record serials in inventory.

   Done when the inventory row exists with serial numbers and the issued date.

7. S7

   First dayowner

   The manager welcomes the employee, hands over the contract copy, and runs the safety briefing per people.workplace-safety-lv.

   Done when the employee has signed the safety-briefing acknowledgement and it is stored in the documents module.

8. S8

   Build the first weekagent

   Create the first-week tasks in the tasks module: system training, introductions, first deliverable, and a probation checkpoint linked to people.probation-review.

   Done when every task has an owner and a due date inside the first week.

9. S9

   Verify and hand backagent

   Read back the onboarding record: VID accepted, mailbox live, accounts match the approved list, inventory row, briefing signed, week planned. Send the manager a three-line summary.

   Done when every item in the record shows an observable fact, not a plan.

Checks — how we know it worked

• VID shows the declaration as accepted for this personal code and start date (read it back from VID, not
• The mailbox receives mail and the employee can log in on day one.
• The account list equals the list approved in S2 — nothing more.
• Inventory shows the equipment with serials against this employee.
• The safety-briefing acknowledgement is signed and stored.
• Payroll has the employee with the correct bank account (the next money.payroll-run will use it).

If it goes wrong

What each step leaves behind

1. S1the record exists and every field is filled from the contract, not from memory.
2. S2the owner has approved both lists as they stand, or named the changes.
3. S3VID shows the declaration as accepted for this employee and start date.
4. S4a test message sent to the address arrives in the new mailbox.
5. S5every approved system lists the new account and no system outside the list does.
6. S6the inventory row exists with serial numbers and the issued date.
7. S7the employee has signed the safety-briefing acknowledgement and it is stored in the documents module.
8. S8every task has an owner and a due date inside the first week.
9. S9every item in the record shows an observable fact, not a plan.

Evidence to keep

VID declaration id and acceptance timestamp · the onboarding record with the approved lists · inventory serials and issue date · signed safety-briefing acknowledgement · the account list as granted · the manager's S9 summary.

How this playbook improves

After every 5 onboarding runs ask: how many days from contract signed to fully onboarded, and which step waited? Did any check in S9 catch an error, or did payroll or the employee find it later? Did anyone get access that people.offboard-employee later had to chase? A new version changes the step that caused the wait or the miss, and says so in its change note.