Why does discretionary access control create risk for onboarding and offboarding?

Discretionary access control creates risk because access decisions are pushed to individual users instead of a central authority. That makes permissions inconsistent, hard to track, and difficult to revoke at scale. Onboarding and offboarding become manual, per-resource tasks, which increases the chance that former employees keep access or that critical resources are left with unclear ownership.

Why discretionary access control is fragile during onboarding and offboarding

discretionary access control is built on local discretion, so the person closest to the resource often becomes part of the access decision. That works poorly for joiner-mover-leaver processes because onboarding and offboarding depend on consistent entitlement changes across many systems, not on ad hoc, per-resource judgement. The result is predictable drift between who should have access and who actually does.

In practice, the risk is not just that access is granted too broadly. It is also that ownership becomes fragmented, revocation is delayed, and exceptions accumulate in places the central security or identity team cannot easily see. That makes the control weak precisely when speed, completeness, and auditability matter most.

Why onboarding breaks down under discretionary control

Onboarding under discretionary access control tends to be inconsistent because each resource owner may apply different standards for similar users. One team may grant access quickly, another may wait for manual approval, and a third may reuse an old entitlement because it is convenient. That inconsistency creates uneven access posture from day one and makes it difficult to prove that the new user has only the access they need.

The problem scales badly when new users need access across shared folders, applications, repositories, and infrastructure tools. Central teams may know that onboarding happened, but not whether every downstream permission was applied, inherited, or documented. A foundational view of IAM and IGA helps explain why central provisioning and entitlement review are usually more reliable than owner-by-owner grants, and NHI lifecycle management shows the same pattern when access must be tracked through provisioning and ownership changes.

Why offboarding is where the risk becomes most visible

Offboarding is the hardest point for discretionary access control because revocation depends on remembering every place access was granted. If access was shared informally, delegated manually, or copied from a previous role, there may be no complete record to revoke against. Former users can retain active access long after departure, especially where teams treat access as a local operational decision instead of a centrally governed lifecycle event.

This is also where orphaned ownership becomes a security issue. Resources can be left with unclear custodianship, stale permissions, and no one confidently responsible for cleanup. That increases the chance that access remains in place after employment ends, and it slows incident response when teams later need to prove who had access to what and when. A related lesson appears in the workforce identity security guide, which treats joiner-mover-leaver handling and deprovisioning as a lifecycle control problem, not a one-off help desk task.

Why the control model itself creates operational drag

Discretionary access control places too much trust in local discretion and too little structure around entitlement governance. That creates a gap between the access model and the operational reality of onboarding and offboarding, where controls must be repeatable, reviewable, and reversible. The more systems and owners involved, the more likely it is that access decisions will be inconsistent, slow to reverse, or impossible to reconcile cleanly.

In mature environments, the answer is usually not to ban local ownership entirely, but to narrow it with central policy, standard role design, and regular recertification. For a broader catalogue of where this goes wrong, Top 10 NHI Issues is useful because many of the same failure modes, such as overprivilege, lifecycle gaps, and hidden ownership, are the same failure modes that make discretionary models brittle for human access too.

Risk and Threat Considerations

Discretionary access control increases the chance that access survives beyond its intended lifecycle, which turns ordinary onboarding and offboarding mistakes into persistent exposure. The most damaging failures are usually not dramatic misconfigurations, but small gaps that accumulate: delayed revocation, unused accounts left active, and permissions that no one can confidently attribute to a current business need.

Failure mechanism: Access is granted and removed through distributed local decisions, so revocation is incomplete when ownership is unclear, records are inconsistent, or teams rely on memory instead of a central entitlement source.

Impact: Former users can retain access, sensitive resources can remain exposed, and audit or incident investigations become slower because no single system can prove the true access state.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	AC-2 — Account Management	Onboarding and offboarding depend on complete account lifecycle control.
	AC-6 — Least Privilege	DAC drift often produces excess permission beyond the user's need.
	IA-5 — Authenticator Management	Offboarding must revoke credentials and other authenticators tied to access.
Recommendation — Centralize account creation, modification, and disabling through formal lifecycle workflows. Restrict permissions to the minimum needed for each role or task. Rotate or revoke authenticators promptly when access is no longer required.
CIS Controls v8	CIS-5 — Account Management	Joiner-mover-leaver failures are primarily account and entitlement management failures.
	CIS-6 — Access Control Management	DAC risk comes from inconsistent permission assignment and revocation.
Recommendation — Maintain an accurate account inventory and disable stale access quickly. Standardize access grants and removals through controlled approval paths.
ISO/IEC 27001:2022	A.5.15 — Access control	DAC risk is fundamentally an access control governance issue.
	A.5.18 — Access rights	Offboarding requires timely removal and review of access rights.
Recommendation — Define and enforce access rules that are centrally governed and reviewable. Review and remove access rights when users change role or leave.

Practitioner Guidance

What to verify: Confirm that every onboarding and offboarding step maps to a single authoritative entitlement source, and that you can produce a complete revocation record for a departed user within the normal business process window. If a resource cannot be cleanly enumerated, it cannot be cleanly offboarded.

What good looks like: Access is assigned through standardised roles or approved workflows, exceptions are visible and time-bounded, and deprovisioning is triggered by a central event rather than by individual resource owners remembering to act.

Practitioner takeaway: The key question is not whether local owners can grant access quickly, but whether the organisation can reliably prove and reverse every grant when the person leaves or changes role.