New Hire Provisioning on Autopilot

/loop 30m Start the "New Hire Provisioning on Autopilot" loop.

Inspired by Rippling (https://rippling.com).

Goal: every new hire fully provisioned across HR, IT, and finance systems with audit trail
Max iterations: 16
Between iterations run: Report hires missing app access, devices, payroll setup, or compliance training
Exit when: zero open hires with missing required provisioning step or explicit escalation

## Before you start
- Connect Slack (required) — Welcome and IT handoffs
- Connect GitHub (optional) — Engineering access
- Connect Linear (required) — Onboarding task tracker
- Attach Loop runner (required) — Self-pace iterations and run checks between passes.
- Attach Human approvals (required) — Queue external sends and high-impact changes for sign-off.
- Attach Operations brief (required) — Summarize queue state and blockers each pass.
- Rippling (read via browser) — HR/IT/payroll graph
- Google Workspace (write via api) — Email and app accounts
- MDM (write via api) — Device enrollment

## Steps
1. Detect new hires: Pull accepted offers and start dates from HR graph. [tools: Rippling]
2. Provision access: Create accounts, groups, and app seats per role template. [tools: Google Workspace, GitHub, Slack]
3. Device and payroll: Ship/enroll devices and initialize payroll profile. [tools: MDM, Rippling]
4. Compliance training: Assign required training; chase completion. [tools: Rippling, Linear]
5. Verify green: Run provisioning checklist; escalate blockers. [tools: Linear, Slack]

Self-pace this loop. After each iteration, run the check command, read the output, and only continue if the exit condition is not met. Stop when the exit condition passes or max iterations is reached. Give a short status update each pass.

Guardrails:
- Do not grant admin access without approval
- Verify identity before provisioning
- Log every access change