How to know they are actually gone

The step that is skipped most and matters most, because the sentence "we have removed their access" is the one the organisation will be held to. Absence of alerts is not evidence of eviction; it is evidence of absence of alerts.

Trigger. Remediation is finished and somebody is about to say so in writing.

The first 120 minutes0 of 5 expire

01 02 03 04 05

060 min120

01
State the eviction hypothesis as something falsifiable
by 20 min
A list: these accounts, these credentials, these hosts, this access path, this persistence. Anything not on the list has not been evicted, it has been assumed.
02
Verify each credential is actually dead
by 60 min
Not reset, dead. Sessions and refresh tokens revoked, keys deleted rather than deactivated, and the reset confirmed against the system of record rather than against a ticket saying it was done.

Tell somebody

Executive, with the eviction list and the explicit limits of what was verified
Legal, before any statement that access has been removed is made externally
The detection team, on the watch period and what specifically it is watching for

Drawn from

The documents these steps come from, so you can check one rather than take it on trust.

The evidence

What each source proves, and what it does not.

logon events

Collect it in one go

A read-only script that gathers most of the above in volatility order, with a hash manifest.

Triage collection

Make it yours

Replace the escalation list with real names, and the timings with what your change process actually allows. A playbook that assumes an authority you do not have will stall at the step that needed it.

State the eviction hypothesis as something falsifiable

Verify each credential is actually dead