Safe to save

The mistake

A planning scenario is entered directly into the live staff records rather than into a separate draft or scenario table, so every employee's leaving date is set to today in the same rows the rest of the business reads. A scheduled offboarding job polls that table for anyone whose leaving date has arrived and deprovisions their accounts, and it cannot tell a hypothetical from a real departure because the record carries no draft flag. The job then runs to completion — disabling accounts, including the operator's own, and firing the leaver notification emails — because there is no scale check or approval gate between reading the list and acting on it.