How to build a device lifecycle sync

What matters here

• No single system is the register. Management sees what checks in, finance sees what was bought, HR knows who is here.
• A device that has not checked in for weeks is an exception, not a row in a report.
• Derive the holder from the HRIS. A typed name goes stale the first time somebody changes team.
• Drive the sync from lifecycle events, not an annual audit. A leaver device should surface the day they leave.
• Report devices held by leavers. That number is a security exposure before it is an asset problem.

Who this is for

You run IT operations or finance systems. Three systems each hold a version of the device estate, none of them agree, and the annual audit is a week of somebody chasing people.

How it works in practice

From a device existing to every system agreeing about it, in order.

1. 1

   Each source is read for what it actually knows

   Management for check-in and state, finance for purchase and depreciation, HR for who works here.

2. 2

   Devices are matched on serial number

   Not on an asset tag somebody typed, which is where most mismatches begin.

3. 3

   The holder is derived from the HRIS

   So a team change updates the record without anybody editing it.

4. 4

   Differences become exceptions with owners

   Not rows in a reconciliation report nobody reads.

5. 5

   Lifecycle events drive updates

   Joiner, leaver, role change, repair and disposal, each triggering the relevant check.

6. 6

   Leaver devices surface immediately

   Because an unreturned laptop is a security exposure before it is a depreciation question.

Paste these into Claude Code or Codex with the Tray Headless plugin installed. Each stage runs on its own. The systems named in them are the worked example rather than a requirement, and every prompt says so.

Once per project, run /tray-workflows:set-workspace to pick the workspace these build in. Point it at a sandbox first.

1. 1

   Set up, then establish what each system actually knows

   Each is authoritative for something and blind to something else.

   Headless skills build-workflow tray-patterns

   Copy

   Use build-workflow. The systems in play are Jamf, NetSuite and
   Workday, or whatever we run in those seats.
   
   For each, tell me what it genuinely knows:
   
     Device management: serial, model, last check-in, OS, encryption state,
     assigned user where set. It cannot see a device that is switched off in
     a drawer.
     Finance: what was purchased, cost, depreciation and disposal. It has no
     idea whether anything is in use.
     HR: who works here and who left. It does not know a device exists.
   
   None of them is the register. The reconciliation between them is the
   product, and treating any one as authoritative is why the numbers never
   agree.

   Match on serial number, never on an asset tag. Tags are typed, mistyped, reused and fall off.

2. 2

   Reconcile three ways and derive the holder

   A typed holder name is stale the first time somebody changes team.

   Headless skills build-workflow

   Copy

   Use build-workflow. Match on serial number across all three, then derive
   the holder from the HRIS instead of an asset field.
   
   Produce these differences:
   
     In finance, never seen by management: never deployed, or lost
     In management, not in finance: bought outside procurement
     Assigned to somebody who has left
     Assigned to nobody but checking in regularly, which means somebody has
     it and nobody knows who
     Not checked in for more than a threshold
     Disposed in finance but still checking in, which is the worst case
   
   Each of those is a different problem with a different owner. A single
   count of unreconciled devices tells nobody what to do.

3. 3

   Turn differences into assigned work

   A reconciliation report is a list; an exception is a fix.

   Copy

   Create a tracked exception per difference, with an owner and a due date,
   rather than producing a report.
   
   Route by type: a leaver device to the IT operations owner and the
   leaver's manager; a device bought outside procurement to the requesting
   team's budget owner; a disposed device still checking in to security
   immediately.
   
   Include what is needed to resolve it: serial, model, last check-in, last
   known holder, purchase date and value.
   
   A reconciliation report that lists ninety differences produces no fixes.
   Ninety assigned exceptions with owners produce most of them, and the
   difference is entirely in the assignment.

4. 4

   Drive it from lifecycle events

   An annual audit finds a year of drift at once.

   Headless skills tray-gotchas

   Copy

   Use tray-gotchas, then trigger checks from events instead of a schedule:
   
     Joiner: a device is assigned and its assignment recorded
     Leaver: on their last day, list what they hold and open a return task,
     and if it has not checked in a week later escalate
     Role or location change: re-derive the holder record
     Repair or replacement: keep the old serial linked to the new one
     Disposal: confirm the wipe certificate before finance writes it off
   
   Keep the daily reconciliation as a safety net, not as the mechanism. The
   events catch things when somebody can still act on them, and the
   reconciliation catches what the events missed.

5. 5

   Report the exposure, not the count

   An unreturned laptop is a security problem before it is an asset one.

   Copy

   Report continuously, not annually:
   
     Devices held by people who have left, with age. This should be zero and
     it is the security number.
     Devices not checked in for 30 and 90 days, with value
     Devices in finance that management has never seen
     Unencrypted devices, which is a compliance exposure rather than an
     inventory one
     Devices approaching end of life, for the refresh budget
   
   Lead with the leaver number. Everything else is asset management and that
   one is an exposure, and the two get very different attention from very
   different people.

6. 6

   Prove it works, then hand the thresholds to IT

   Because check-in expectations differ by device type.

   Copy

   Run the per-step schema checks and the whole-workflow audit before this
   touches production.
   
   Then open the same workflow in Tray Build so IT operations can adjust the
   check-in thresholds, the exception routing and the escalation timings in
   the visual canvas. A laptop and a rarely used spare have very different
   expected check-in patterns.

What it connects to

Three systems each hold part of the truth and the reconciliation is the product.

Named systems are the ones most teams run, not the only ones that work. Each is an authentication in your Tray workspace, referenced by name, so the workflow never holds a credential. Where we have a connector page, the name links to it.

Questions people ask

Related guides