Best way to disable an account once roles are removed

Thanks both, before rule seems better way to go than workflow.