I was working at a medium sized accounting software firm over a decade ago when I was called into the CEOs office and sat down for an interrogation.

Apparently they had setup their Exchange server poorly and I'd had access to any number of mailboxes (including the CEOs) and other folders that I wasn't supposed to have access to. I was completely unaware of this access, but was being directly accused of having access confidential information.

I insisted, truly, that I wasn't aware of the access and hadn't looked at anything confidential, but they tried to tell me they had proof that I had accessed email I shouldn't have. At this I got upset and demanded they show me this proof, which they couldn't do because they didn't have any, but I'm guessing they thought I had seen some stuff and they could get me to cave it if they pretended they had proof.

Anyways, I didn't get in any real trouble because I wasn't intimidated, but it damaged the relationship and I ended up quitting a few months later. Now I feel the same way as OP, I don't want to be in a position where someone can make a plausible accusation of misconduct, you could be totally honest and still end up railroaded just for being in the wrong place at the wrong time. CYA.

What's threatening? I read that as just wanting their access removed as per policy/procedure, with no special treatment, because that both protects the employer from potential tampering and the employee from accusations of such tampering.

I don't read any implied threat that they actually intend to or think they might do something harmful, just wanting a CYA in the same way the company wants one.

That's exactly it. I'm not asking them to save me from temptation or anything like that, or to provide me an alibi ("ok, you're locked out now wink"). I want them to do the right thing for our mutual benefit.

Pretty sure they read

"If I can't get in, they can't blame me if something goes wrong down the road."

as

"If I can get in, they can't blame me if something goes wrong down the road."

That's the only interpretation that sounds threatening.

Ohhhhh, that makes much more sense now. If I read it that way, I'd also think I was a creep.

Yep, they confirmed it.

Just because someone wants plausible deniability doesn't mean they're considering doing something wrong.

They could just not want to be even considered a candidate for blame.

For example, if I was ever asked to babysit someone, I would want them to install a camera pointing at me at all times, for my sake and their peace of mind.

> That is very threatening

It's just creating "plausible deniability."

> or look internally to figure out what makes you think this way.

That's easy: Sarbanes-Oxley.

For me, HIPAA. I do not want access to a single resource or record that I don’t require to do my job.

If I work in a place where the data security practices are abysmal, where we have not been hacked and ransomed/extorted purely because nobody has bothered, I would definitely want to make sure that my access to any systems is revoked once I am no longer employed. I would not want to be anywhere close to a ticking bomb.

Emotions aside, isn’t it just sensible security policy to delete all permissions and invalidate all credentials of a terminated employee as soon as possible? Any other approach would be exceptional.

Both sensible, and required by many compliance frameworks.

It's called being a grownup. If I worked for a restaurant and was fired, I'd give them the keys immediately. If someone unlocked the door and stole stuff later, hey, look at someone else who still has the keys. I don't.

It's the same here. If I'm fired from a tech job, the company should do the right thing to protect themselves and lock me out right then and there. It's not because I -- the real me, not the hypothetical villainous me -- pose a risk to them. I wouldn't hurt an ex employer under any circumstances because 1) that's a bad thing to do, and 2) I don't want to be in jail. It's more that best practice dictates they do this. There's no benefit to them whatsoever in allowing me into systems I no longer have a legitimate need to access.

And again, this also protects me. If I'm long gone and something suspicious happens, talk to their current employees, not me. I don't want to access to their stuff, and I couldn't even if I wanted to.

Edit: Ah, honest mistake. I could see why you'd think that given the misreading.

I don't see how that's incompatible with wanting your access revoked on termination to avoid accusations of wrongdoing.

who's threatening whom?