Fulfiller user cleanup

[JakeBaynes]

Hey SN people,

New job, trying to clean up fulfillers, it's a mess lol.

I wanted to post my workflow to see if what I'm doing makes sense to others and whether it is going to accurately identify where we can clean things up.

Our account reps have provided a report of all users who have roles that are considered fulfillers and how that all ties in to our subscriptions.

We have a custom built app that extends the incident table which has two roles, one of which has been given to way too many people and it is flagged as a fulfiller role.

I have been using this query on the User has roles table.

user.active=true^user.last_login_timeRELATIVEGT@dayofweek@ago@365^user.internal_integration_user=false^role.nameIN{fulfiller roles}

This gives me all users who have one of the roles identified in our account reps report, have logged in within the last 365 days, are not internal integration users, and are active.

I then used the Task table with a similar query to get all tasks that have been assigned to a user who has one of the roles listed, logged in within last 365 days, not an internal integration user, and is active.

I then used the Python Pandas library to take the two sets of users, merge them with what is essentially a left inner join, which gets all users who have never been assigned to any Task (Incidents, Requests, etc.) and have one or more of the highlighted roles.

       LEFT                                                           INNER LEFT                                                            RIGHT

(users with roles(<-users who have never been assigned to a task)tasks assigned to users with roles)

I'm trying to understand if there are any other criteria that would make someone a fulfiller that I'm not thinking about. 

I appreciate any incite!

[Rafael Batistot]

Hi @JakeBaynes 

Gaps / Extra Criteria to Consider:

1. Groups & Assignment Rules – Some users may fulfill tasks indirectly (via group membership, not direct assignment). Check if they are in assignment groups that actually handle work.
2. Delegated or Secondary Activity – Look at approvals, catalog tasks, or change tasks. Some users may not touch Incidents/Requests but still act as fulfillers in other processes.
3. Role Inheritance – Some roles come bundled with others (e.g., itil being inherited). Make sure you’re not double-counting or missing indirect role assignments.
4. License Type Mapping – Fulfillment is often tied to subscription allocation. Compare your findings against license reports to see if SNOW is already flagging unused licenses.
5. Edge Cases – Contractors or temporary staff who still should have the role but haven’t had recent tasks. Decide how far back you want to look (365 days may or may not be enough).

Bottom line: Your workflow makes sense and should identify a big portion of unnecessary fulfillers, but also check group activity, other task types beyond Incident/Request, and role inheritance to avoid removing legitimate but less visible fulfillers.