When onboarding and offboarding are not automated, access changes depend on people remembering to act. That creates delays for new hires, access creep for departing employees, and more chances of giving the wrong person the wrong application. It also weakens compliance because the organisation loses a reliable, timely record of who should have access.
When provisioning is manual, access and timing stop being reliable
automated provisioning is what makes joiner, mover, and leaver events predictable. Without it, the organisation is depending on human memory, ticket queues, and follow-up discipline, which means the access model becomes inconsistent from day one. New hires may wait for access, while role changes and departures can leave behind stale entitlements that no one has formally reconciled.
The practical issue is not just delay. Manual steps break the link between employment status and actual application access, so the security team cannot trust that a user’s permissions reflect their current role. That creates a gap between what the business believes is true and what systems actually allow.
That same lifecycle gap is why NHI governance often fails in the same places as human access governance, especially where credentials and application access are tied to onboarding and offboarding workflows. NHI lifecycle controls are strongest when provisioning, rotation, and deprovisioning are treated as a single process rather than separate tasks, as outlined in NHI Lifecycle Management Guide and the broader lifecycle processes for managing NHIs.
What usually breaks first: least privilege, revocation, and auditability
When provisioning is not automated, the first failure is usually overexposure. People get broader access “just to get started,” and that access is rarely tightened later. Offboarding creates the reverse problem, where access should be removed immediately but instead lingers until someone notices, which is how entitlement creep and orphaned access accumulate.
Auditability also degrades quickly. If access changes happen through ad hoc tickets, emails, or verbal approvals, the record of who approved what and when becomes fragmented. That makes it harder to prove that access was granted appropriately, and harder still to show that access was removed on time when someone leaves.
In identity-heavy environments, this is where permanent access paths become a real control failure. NHI-focused guidance consistently treats lifecycle visibility and revocation as core controls because unmanaged access can persist long after the business event that justified it has ended, which is also why the issue belongs in Top 10 NHI Issues. For broad identity governance, the same lifecycle weakness is visible in the Ultimate Guide to NHIs.
One useful data point here is that 91% of former employee tokens remain active after offboarding, which shows how quickly manual processes turn into real exposure when revocation is not tightly automated and verified.
Why this becomes a security and compliance problem, not just an HR problem
Broken onboarding and offboarding are not limited to inconvenience. They create an access-control weakness that attackers can exploit through stale accounts, lingering tokens, excessive privileges, and shared application access. They also undermine compliance because reviews and certifications lose value when the underlying access state is already out of date.
The security consequence is broader than a single missed revocation. A departed employee’s access can become a persistence point, and a rushed onboarding can grant the wrong person the wrong application at the wrong time. Both conditions increase the chance of unauthorized access, data exposure, and operational disruption.
For practitioners, the strongest evidence of the problem is not the ticket volume, it is whether access state can be trusted to match reality. That is why lifecycle failures are so often linked to leaked or overused credentials, and why formal offboarding and revocation processes are essential to reducing blast radius. The issue is especially clear in The 2025 State of NHIs and Secrets in Cybersecurity, which reports that 91% of former employee tokens remain active after offboarding.
Risk and Threat Considerations
Manual onboarding and offboarding create a durable access-control gap. That gap is attractive to both insiders and external attackers because it leaves stale accounts, delayed revocation, and excessive access in place long enough to be discovered and abused.
Failure mechanism: Access changes depend on human follow-through instead of system-enforced lifecycle events, so revocation slips, approvals are delayed, and permissions drift away from the user’s real status.
Impact: The result is unauthorized access, longer dwell time for compromised accounts, harder audits, and a larger blast radius when a person leaves or changes role.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Lifecycle and Offboarding | Manual onboarding/offboarding leaves non-human access lingering past need. |
| NHI-03 — Secrets and Credential Management | Provisioning gaps often leave credentials and tokens active after role changes. | |
| Recommendation — Automate lifecycle events to revoke stale access and prevent entitlement drift. Bind credential issuance and revocation to lifecycle events and verify removal. | ||
| NIST CSF 2.0 | PR.AC — Access Control | Automated provisioning enforces timely access changes and least privilege. |
| GV.PO — Policy | Joiner-mover-leaver processes need formal policy and ownership to stay reliable. | |
| Recommendation — Implement access provisioning and revocation controls that track employment status. Define policy for onboarding and offboarding approvals, timing, and evidence retention. | ||
| CIS Controls v8 | 6 — Access Control Management | CIS emphasizes managing accounts and removing access when it is no longer needed. |
| 5 — Account Management | Account lifecycle control directly addresses delayed onboarding and offboarding. | |
| Recommendation — Revoke unused access promptly and review account assignments on role change and exit. Provision, disable, and delete accounts through controlled lifecycle workflows. | ||
Practitioner Guidance
What to verify: Check whether joiner, mover, and leaver workflows are actually tied to the authoritative source of employment or contractor status, not just to a ticket process. If a user can leave the organisation without the access graph changing on the same day, the control is not dependable.
Decision rule: If access to a production application, token, or privileged path can survive after a role change or termination event, treat that as a remediation priority before spending time on access optimisation. The question is whether access can be removed or adjusted without waiting for someone to remember.
Practitioner takeaway: Automated provisioning is valuable because it turns access changes into a governed lifecycle control, not an administrative best effort; if the process is manual, assume the organisation is carrying hidden stale-access risk until proven otherwise.
