The set of states a governed relationship passes through, including creation, validation, renewal, suspension, transfer, and termination. In practice, this lifecycle should trigger access changes so governance stays aligned with current business reality.
What the relationship lifecycle includes
Relationship lifecycle describes the full sequence of states a governed relationship can move through, from creation and validation to renewal, suspension, transfer, and termination. The important idea is that the relationship is not static, governance must follow state changes.
In practice, this term is broader than onboarding and offboarding alone. A relationship can change hands, be paused, expire, or be revalidated when business context changes, and each of those transitions can change who may act, what may be approved, and whether the relationship still deserves active trust.
The lifecycle framing is useful because it turns governance into a continuous condition rather than a one-time event. When the relationship state changes, the access, responsibility, and oversight attached to it should change as well.
Why lifecycle state changes matter
Lifecycle state is the point at which governance decisions become concrete. Creation and validation establish that the relationship should exist at all, while renewal confirms that it still has business justification. Suspension and termination, by contrast, are the moments where continued access or authority should stop or be narrowed.
This is why lifecycle management is closely tied to identity governance and access governance. If the relationship changes but the associated access does not, organisations accumulate stale permissions, unowned relationships, and approvals that no longer match reality.
Well-run lifecycle processes also reduce ambiguity during handoffs. Transfer matters because a relationship may remain legitimate while the accountable party changes. Without a defined transfer state, teams often leave old permissions in place longer than intended.
Common failure modes in relationship governance
The most common failure is treating the relationship as permanent after initial approval. That leads to stale access, missed renewals, orphaned ownership, and relationships that remain active after the original purpose has ended.
Another failure is inconsistent state handling across systems. If one system suspends the relationship but downstream tools keep the prior access path alive, the organisation can think the relationship is inactive while effective access remains enabled.
Transfer and termination are especially sensitive because they are easy to under-automate. A relationship can be formally closed in one record while tokens, delegated permissions, linked accounts, or approval paths still persist elsewhere.
How practitioners should interpret the term
Practitioners should use relationship lifecycle as a governance lens, not merely a process label. The useful question is whether every state transition causes the right access, ownership, and review changes to happen at the right time.
IAM and IGA Basics provides the broader access-governance context for lifecycle thinking, especially where relationship state drives provisioning, reviews, and entitlements. For lifecycle execution itself, Joiner-Mover-Leaver (JML) Guide is a useful model for understanding how state changes should trigger access changes. Where lifecycle weakness leaves credentials behind after closure, NHI Lifecycle Management Guide shows the same control pattern applied to governed non-human relationships.
For a broader control perspective, lifecycle management should be paired with revalidation, revocation, and ownership checks rather than assumed to work through documentation alone. A lifecycle process is only effective when the system of record, the approval state, and the active access state stay aligned.
Risk and Threat Considerations
Relationship lifecycle creates risk when state changes are not reflected quickly across the systems that depend on that relationship. Stale relationships can preserve access longer than intended, and a terminated or suspended relationship may still have active privileges if revocation is incomplete.
Failure mechanism: Weak lifecycle enforcement leaves old access paths, ownership records, or delegated permissions in place after the relationship has changed. That gap can be exploited through continued use of stale trust, delayed offboarding, or unreviewed renewal.
Impact: The result is overexposure, unauthorized continued access, and governance failure, especially where relationship state is used as the basis for approvals, privileges, or downstream trust decisions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Lifecycle states drive provisioning, review, and revocation of relationship-linked access. |
| IA-5 — Authenticator Management | Lifecycle governance must cover credentials and authenticators tied to the relationship. | |
| AC-6 — Least Privilege | Relationship transitions should narrow or remove privileges when business need changes. | |
| Recommendation — Tie relationship state changes to account creation, modification, review, and removal. Rotate, revoke, and retire authenticators when the relationship changes or ends. Reassess privileges at each lifecycle stage and remove excess access promptly. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | Relationship lifecycle depends on controlled identity and relationship state changes. |
| A.5.18 — Access rights | Lifecycle transitions should update access rights so trust stays aligned with current need. | |
| Recommendation — Maintain authoritative identity records that reflect each relationship state. Review and withdraw access rights when the relationship is renewed, suspended, transferred, or terminated. | ||
Practitioner Guidance
Governance implication: Treat each lifecycle transition as a control point, not an administrative update. Creation, renewal, suspension, transfer, and termination should all trigger a decision about whether access, ownership, or oversight must change.
What to watch for: Pay special attention to relationships that are renewed by habit, transferred without clear handoff ownership, or terminated in the business process but not in the access system. Those are the places where lifecycle drift usually accumulates.