TL;DR: Manual onboarding, offboarding, and approval workflows between HR and IT create delays, visibility gaps, and access errors that can leave employees without the right tools or keep access alive after departure, according to Zluri. The real issue is not productivity alone, but whether lifecycle governance can keep pace with identity changes.
At a glance
What this is: This article argues that HR and IT lifecycle automation is really an access-control problem, because manual workflows create delayed provisioning, poor visibility and lingering access.
Why it matters: It matters because IAM and IGA teams need lifecycle processes that can keep pace with employee movement, or access will remain misaligned with role changes and departures.
Context
HR and IT lifecycle management is the coordination of joiner, mover and leaver processes across employee records, access requests and application permissions. When those workflows sit in separate systems or depend on tickets, the organisation loses timing, consistency and traceability across identity changes.
The article’s core governance gap is not simply productivity. It is the mismatch between workforce events and access administration, where onboarding can lag, approvals can bottleneck, and offboarding can leave licenses and application access active after departure.
Key questions
Q: How should teams integrate HR events into access governance?
A: Teams should connect HR lifecycle events directly to provisioning and revocation workflows so identity state changes drive access changes automatically. The goal is to remove manual handoffs, shorten delay between workforce change and access update, and keep joiner, mover and leaver controls aligned with the authoritative source of employment data.
Q: Why do manual onboarding and offboarding processes increase security risk?
A: Manual processes create delay, inconsistency, and missed handoffs, which means privileges can outlive the business event that should have changed them. That increases the likelihood of stale access and makes it harder to prove compliance. The more fragmented the environment, the bigger the gap between policy and reality.
Q: What are the signs that lifecycle governance is failing?
A: Look for dormant entitlements that stay active, high-risk grants that go unnoticed, and role changes that do not immediately trigger review. Those are observable signs that access governance is operating on stale state instead of current identity context.
Q: Should organisations use ticketless approvals for every access request?
A: No. Ticketless approvals work best for repetitive, policy-defined requests with clear roles and owners. High-risk or unusual access should still go through explicit review. The decision is about reducing avoidable ticket noise while preserving human oversight where the access change is exceptional or sensitive.
Technical breakdown
Why HR system integration changes lifecycle governance
HR systems often hold the first authoritative signal that a person has joined, moved role or left. When IT does not consume that signal directly, access changes become delayed, manual and easy to miss. Integration matters because identity governance depends on timely source data, not just better process discipline. In practice, the problem is not only data sync. It is whether downstream access decisions are triggered from a reliable lifecycle event rather than from a human remembering to raise a ticket.
Practical implication: connect HR events to access workflows so joiner, mover and leaver changes are driven by authoritative lifecycle data.
How onboarding and offboarding automation reduces access drift
Onboarding and offboarding are high-volume lifecycle actions that expose whether access governance is actually repeatable. Manual handling creates inconsistent provisioning, slow approvals and unnecessary lingering access when employees leave. Automated workflows reduce that variance by applying predefined access sets, revoking SaaS licenses and transferring ownership where needed. The technical point is that lifecycle automation is a control boundary, not just an efficiency layer: it determines whether access state tracks employment state closely enough to stay governed.
Practical implication: use automated onboarding and offboarding workflows to keep access state aligned with employment state.
Why ticketless approval flows change access decision quality
Ticket queues can become the place where access governance loses speed, context and accountability. If every request depends on manual routing, the control becomes slower than the business event it is meant to govern. Self-service models and role-aware approval routing reduce that delay by standardising recurring decisions and limiting human intervention to exceptions. That does not remove governance. It shifts it toward policy-defined access paths, which is the only way lifecycle controls scale without turning every request into an ad hoc exception.
Practical implication: replace repetitive access tickets with policy-driven approval paths and clear owner-based exception handling.
Breaches seen in the wild
- Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
- Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Lifecycle automation is now an access-control issue, not a workflow convenience issue. When HR and IT do not share a live lifecycle signal, the organisation is effectively asking access decisions to trail employment reality. That creates inconsistent provisioning at join time and delayed revocation at leave time, which is exactly where governance fails. The practitioner conclusion is straightforward: lifecycle orchestration has to be treated as a core access control plane, not an administrative afterthought.
Joiner-mover-leaver processes break when identity events are handled as tickets instead of state changes. Tickets add latency, introduce human routing errors and make it harder to prove that access matched the person’s current role. The article reinforces a familiar IGA pattern: the longer lifecycle events wait in a queue, the more likely access will be wrong by the time it is approved. Teams should see this as a governance timing problem, not only an automation opportunity.
Offboarding quality is the clearest test of lifecycle governance maturity. If SaaS access and app ownership can remain active for days after departure, the control is not keeping pace with identity change. That exposes the gap between policy intent and operational execution, especially where licenses, cloud directories and shared ownership need coordinated revocation. Practitioners should treat offboarding as the control that proves whether lifecycle governance is real or merely documented.
Identity surface alignment: the article shows that HR and IT must govern access from the same lifecycle event stream. Zluri’s framing points to a broader truth in identity programmes: when the source of workforce change and the system of access change diverge, control quality drops across onboarding, approvals and leavers. The implication is that lifecycle governance needs shared state, not just shared intent.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
- Read next: NHI Lifecycle Management Guide
What this signals
Identity surface alignment: lifecycle governance fails when workforce events and access events are managed in different systems or at different speeds. The practical challenge is not automation for its own sake, but whether a joiner, mover or leaver event becomes an access decision fast enough to stay accurate.
Lifecycle automation is strongest when it removes repetitive decisions from tickets and places them into policy-defined workflows. That shift matters because access control quality is measured by how well the programme keeps pace with identity change, not by how many requests it can process.
The offboarding test remains the most revealing. If SaaS licenses, directory entitlements or app ownership remain active after departure, the organisation has a lifecycle control problem that no amount of process documentation can hide.
For practitioners
- Integrate HR events with access workflows Use HR as the authoritative trigger for joiner, mover and leaver changes so provisioning and revocation follow workforce state instead of manual tickets.
- Automate onboarding and offboarding runbooks Define standard workflows for software assignment, license removal, and ownership transfer so routine lifecycle actions do not depend on ad hoc operator judgment.
- Reduce ticket-based access approvals Move repetitive access requests into policy-driven approval paths and reserve tickets for exceptions that truly need human review.
- Review offboarding revocation timing Check how quickly SaaS access, app licenses, and cloud directory entitlements are removed after departure, then close any delay that leaves access active longer than necessary.
Key takeaways
- Manual HR and IT handoffs create lifecycle drift, which turns access administration into a lagging process instead of a governed one.
- The strongest evidence of the gap is delayed provisioning, lingering access after departure and repeated reliance on tickets for routine requests.
- Automating lifecycle workflows matters because identity changes should drive access changes immediately, with human review reserved for exceptions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about keeping access aligned to employee lifecycle state. |
| Recommendation — Align access entitlements with lifecycle events and remove delays between workforce change and authorization updates. | ||
| CIS Controls v8 | CIS-5 — Account Management | Onboarding and offboarding are core account-management workflows in the article. |
| Recommendation — Automate account lifecycle actions and revoke access promptly when employment status changes. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Role-based access and offboarding timing both affect whether users retain only needed access. |
| Recommendation — Apply least privilege to lifecycle workflows so new access is granted narrowly and removed without delay. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article highlights lingering access after departure as a lifecycle failure mode. |
| NHI-05 — Overprivileged NHI | Predefined role grants can still over-assign access if lifecycle rules are too broad. | |
| Recommendation — Track leaver workflows against offboarding controls and revoke credentials, licenses and ownership on exit. Review role templates so onboarding does not grant broader access than the job requires. | ||
Key terms
- Joiner Mover Leaver: Joiner Mover Leaver is the identity lifecycle process for creating, changing, and removing access as people enter, change roles, or leave an organization. It governs provisioning, modification, and deprovisioning across systems, ensuring access matches current job needs and reducing orphaned accounts, privilege creep, and residual access risk.
- Lifecycle Governance: Lifecycle governance is the set of controls that cover creation, assignment, review, rotation, and retirement of identities and credentials. For NHIs, it is the difference between a temporary automation asset and a persistent access risk. Strong lifecycle governance keeps ownership and expiry tied to actual business use.
- Answer Drift: Answer drift is the gradual change in a model’s responses over time, often showing up as reduced consistency or increasing error rates. It can signal degraded grounding, shifting data quality, or prompt and retrieval issues. Monitoring drift helps teams catch reliability problems before they become widespread user-facing failures.
- Provisioning Delay: Provisioning delay is the time between an identity event and the moment the correct access state is in place. Longer delays increase the chance that users wait for tools they need or retain access they should no longer have, which weakens both productivity and control quality.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org