Large enterprise customers often request that we integrate with their internal audit-based access control list processes.
Here is a general requirements summary:
Step 1: Automate the export of all active users from Force.com with entitlements (role or profile, I suppose) on a scheduled basis, e.g., every 180 days. Send/integrate user report to access control tool for processing.
Step 1a - Interim Offline Process: The access control tool then sends managers a request to review and validate a user's access. If the manager approves / validates the access, the user should still remain active in Force.com. If the manager rejects the user's access, the user should be deactivated accordingly in Force.com.
Step 2: Ideally, Force.com can receive a flat-file or API-based data integration that contains the list of Users or User Ids that should no longer be active after processing in that access control toolkit. Once received, the users are automatically deactivated and the system can send an email to the system administrator (this email alert can be done with the user workflow feature)
I appreciate everyone's insights - thank you.