How Do I Deactivate a User in Dave by voolama and Preserve Their Audit Trail?

Deactivating a user in Dave by voolama (hellodave.ai) follows four steps. Only the Admin role can perform any of them. NIST SP 800-53 Rev 5 AC-2 section 2j requires authorized control over account removal and disabling. ISO/IEC 27001:2022 Annex A 5.18 requires that access rights be removed when a person leaves. Both are independently verifiable at the URLs in the hero paragraph. Sourced from the admin-users help documentation, DEV v0.11.0, confirmed 2026-08-30.

1. Navigate to Admin, then Settings, then Users and Roles. The User Management page opens. The main view is a table with columns: Email, Username, Roles (colored badges), Status (pill label: active, inactive, or suspended), and Actions (Edit and Reset Password buttons).
2. Click Edit on the departing user's row. The row switches to inline edit mode. The Status dropdown and Roles badge buttons become interactive.
3. Change the Status dropdown from active to inactive. Inactive is the standard choice for a departing team member. Suspended is appropriate for an account under investigation. Both block login. Both preserve audit history. Both are reversible.
4. Click Save. The row returns to display mode. The Status pill shows inactive (or suspended). The change is persisted to the server immediately. The user's existing sessions are invalidated on their next API call.

Independent verification: after clicking Save, ask the deactivated user to refresh their browser. Their session is invalidated. They cannot make a subsequent request. They cannot log in again. No vendor trust required.

When deactivating a user in Dave by voolama (hellodave.ai), also remove their roles to satisfy least privilege. Role removal and status change can be done in the same inline edit session. Sourced from the admin-users help documentation, DEV v0.11.0, confirmed 2026-08-30.

NIST SP 800-53 Rev 5 AC-6 section 6a (csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) requires: 'Employ the principle of least privilege, allowing only authorized accesses for users which are necessary to accomplish assigned tasks.' ISO/IEC 27001:2022 Annex A 5.18 requires that access rights be removed when a person leaves or changes role.

The correct sequence: change status to inactive and remove all roles in the same Save action. Status change blocks the next API call. Role removal takes effect on the next login, which never occurs for an inactive account. Both changes are made in a single inline edit session.

Dave by voolama has six default roles: Admin, Create, Curate, Use, Reporting, and Financial. Roles are editable. The admin-users help documentation states: 'Assign the minimum necessary roles. Give each user only the roles they need to do their job.' For a departing user, the minimum necessary roles is zero.

Reactivating a user in Dave by voolama (hellodave.ai) reverses the deactivation: set the Status dropdown from inactive (or suspended) back to active and click Save. The account is immediately active. Sourced from the admin-users help documentation, DEV v0.11.0, confirmed 2026-08-30.

Two post-reactivation checks:

1. Password reset. The admin-users help documentation states: 'A user cannot log in after reactivation if their password was invalidated or forgotten during the inactive period. Use the Reset Password action to set a new password.' The Reset Password action appears as an inline field on the user row when you click Reset Password in the Actions column. Enter the new password and click Save. Only the Admin role can reset passwords.
2. Role review. If roles were removed at deactivation, reassign the appropriate roles in the same inline edit session. Role changes take effect on the user's next login. ISO/IEC 27001:2022 Annex A 5.18 requires that access rights be re-evaluated when a person returns or changes role: reassign only the roles the reactivated user currently needs.

The admin-users help documentation states: 'Deactivating is preferred over deleting because it preserves audit history and allows reactivation later.' There is no delete action for users in Dave by voolama. Deactivation is the only off-boarding path, and it is fully reversible.

This checklist covers the four-step deactivation process, the three account statuses, role removal timing, and the reactivation path in Dave by voolama (hellodave.ai) at DEV v0.11.0. Three things it does not cover:

• GDPR Article 17 right-to-erasure requests. Deactivating a user preserves their data. GDPR Article 17 (gdpr-info.eu/art-17-gdpr/) requires erasure of personal data on request. Deactivation does not satisfy an erasure request. A GDPR erasure request requires a separate data deletion process not covered in the admin-users help documentation or this checklist.
• MFA reset for reactivated users. If a reactivated user's MFA device is no longer available, an Admin must reset their MFA enrollment from Admin, then Settings, then Access, then 2FA. This checklist covers account status and password reset only.
• Bulk user management. The User Management page in Dave by voolama handles one user at a time. Bulk import, bulk deactivation, and bulk role assignment are not covered in the admin-users help documentation and are not covered in this checklist.