TL;DR: Clarity Security shows that onboarding breaks when HR can track the hire, but not whether role-based access is actually provisioned before day one, leaving new employees frustrated and managers firefighting. The real control gap is lifecycle visibility: access has to be ready, traceable, and reversible across joiner and leaver events, not assembled by email threads.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Clarity Security's blog post: Day-one onboarding fails when access provisioning is scattered across HR, IT, and application owners, and visibility into access readiness is the missing control.
Why it matters: IAM teams, IGA leads, and HR security stakeholders need to treat onboarding access as a governed lifecycle outcome, because lack of visibility turns a routine joiner process into delayed productivity and avoidable access drift.
👉 Read Clarity Security's analysis of HR onboarding access visibility and the day-one IAM gap
Context
Day-one onboarding breaks when the employee record and the access record do not move together. In practice, HR can complete the human side of onboarding while the identity side remains fragmented across IT queues, application owners, and manual approvals.
That is an IAM and IGA problem, not an HR problem. When access readiness is invisible, no one can confirm whether a role has been provisioned, whether a request is pending, or whether the employee is starting with incomplete access.
The article frames visibility as the control that links joiner and leaver processes into one lifecycle. That makes the onboarding gap easier to spot, but it also shows why lifecycle management has to be measurable, not assumed.
Key questions
Q: What breaks when onboarding access is not visible to HR and managers?
A: The joiner process breaks at the point where responsibility and execution diverge. HR may know the employee has started, but without access visibility it cannot tell whether the right tools are available, pending, or missing. That leaves the new hire waiting, managers improvising, and IT reacting after the fact instead of before day one.
Q: Why do automated onboarding and offboarding flows create IAM risk?
A: Because they can move faster than ownership, approval, and revocation processes. If a workflow creates access before the right approver has validated it, or if it fails to remove access after a leaver event, the organisation scales the mistake instead of the control. The risk is lifecycle drift, not automation itself.
Q: How do you know if onboarding access controls are actually working?
A: Onboarding controls are working when new hires receive only the access required for their role, exceptions are rare and documented, and early access reviews remove unnecessary entitlements quickly. If support requests regularly trigger manual one-offs or if access differs widely by manager, the process is already drifting away from control.
Q: What should teams do when self-service access requests still leave gaps?
A: They should treat the portal as one step in a governed workflow, not as the control itself. Requests need clear ownership, approval status, and fulfilment tracking so that unstandardised access is visible to HR and managers. Otherwise the organisation has digitised the delay rather than removed it.
Technical breakdown
Why onboarding access breaks in multi-team provisioning
Onboarding access usually fails because provisioning is split across systems with different owners, different approval paths, and different timing. HR may trigger the process, but IT, application teams, and workflow tools each hold part of the state. That creates a blind spot: no single party can tell whether the right entitlements were created, delayed, or skipped. The technical issue is not just automation coverage. It is the absence of a shared workflow state that connects the HR event to role-based access decisions and confirms completion before the employee starts.
Practical implication: map every joiner workflow to a single source of truth for access completion, not to scattered email approvals.
Self-service requests do not replace governed visibility
Self-service request portals help when standard onboarding profiles do not cover every access need, but they only work if requests remain traceable through approval and fulfilment. Otherwise the process simply moves the gap from inboxes to a portal. The useful technical pattern is not just request capture. It is status visibility, routing logic, and exception handling so HR and managers can see what is pending without chasing every application owner. That is what turns the portal into a governance surface rather than a convenience layer.
Practical implication: require status tracking and owner accountability for every access request that falls outside the default profile.
Why offboarding must share the same lifecycle view
The article correctly ties onboarding visibility to offboarding because both depend on the same lifecycle record. If access is provisioned from HR state, it should also be revoked from exit state. Without that symmetry, organisations create a common identity failure mode: access is granted through a governed event but removed through memory, email, or manual follow-up. The technical lesson is that joiner and leaver controls are only as strong as the weakest lifecycle handoff, especially when applications have different deprovisioning timelines and approver paths.
Practical implication: connect joiner and leaver workflows so deprovisioning follows the same governed path as provisioning.
Breaches seen in the wild
- Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Day-one access gaps are a lifecycle governance failure, not an HR execution problem. The article shows that onboarding can be complete on paper while access remains incomplete in practice. That matters because the accountable team is seeing outcomes without seeing the inputs. The operational conclusion is that lifecycle governance must include access readiness, not just employee start dates.
Joiner visibility is the missing control surface in many IAM programmes. HR, IT, and application owners often each know part of the process, but none of them owns the whole state. That creates the classic governance gap: responsibility without observability. Practitioners should treat this as an access governance issue that belongs in IGA and joiner lifecycle design, not in ad hoc escalation chains.
Access readiness and access removal are the same governance problem viewed from opposite ends. If an organisation cannot confirm that access is ready at start time, it often cannot confirm that access is gone at exit time either. The deeper lesson is that lifecycle discipline is only real when it covers both provisioning and revocation with the same visibility model. Teams should design onboarding and offboarding as one control plane.
Named concept: access readiness visibility. This article sharpens a practical concept that identity teams often leave implicit: the ability to see whether the right access exists before the employee needs it. Without that view, onboarding becomes a chain of assumptions rather than a controlled process. Practitioners should treat access readiness as a measurable lifecycle state, not an informal expectation.
What looks like a service issue is really an identity operating model issue. The moment HR has to chase IT for every missed entitlement, the programme has lost control of the joiner workflow. The right question is not who answered the email. It is whether the organisation can prove, before day one, that the employee’s access state matches the role state. That is the standard to design for.
What this signals
Access readiness visibility: The useful governance shift is no longer whether onboarding is automated, but whether the organisation can prove that the right access exists before the employee needs it. That changes onboarding from a service desk problem into a measurable lifecycle control.
When HR can see status across provisioning and deprovisioning, joiner and leaver events become one continuous control plane rather than two disconnected processes. That is the operating model identity teams should be aiming for.
The practical benchmark is simple: if an onboarding issue is only discovered by the new hire, the programme is already too late. Mature IAM teams surface missing access before the first login, not after the first complaint.
For practitioners
- Map the joiner workflow to a single access state Define one authoritative workflow state for each new hire so HR, IT, and application owners can see whether access is pending, approved, provisioned, or missing.
- Track day-one access readiness by role For every standard role, list the applications and shared resources that must be available before the employee starts, then verify completion against the HR record.
- Expose exception requests through governed self-service Route non-standard access requests through a visible approval path so managers and HR can see what is waiting and who owns the next action.
- Tie offboarding to the same lifecycle record Use the same identity record that provisions access on joiner events to trigger revocation on leaver events so removal does not depend on manual follow-up.
Key takeaways
- The article shows that onboarding failures often come from poor access visibility rather than poor HR execution.
- It also shows that the same lifecycle gap affects both start-of-employment provisioning and end-of-employment revocation.
- The control that changes the outcome is a governed, shared view of access readiness tied to the HR lifecycle.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about proving access is ready and correct at onboarding time. |
| Recommendation — Map joiner workflows to PR.AA-05 so entitlements are visible before the employee starts. | ||
| CIS Controls v8 | CIS-5 — Account Management | Onboarding and offboarding both depend on controlled account lifecycle handling. |
| Recommendation — Use CIS-5 to centralise account provisioning and revocation across the employee lifecycle. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The access readiness problem hinges on timely provisioning and revocation of authenticators and related access. |
| Recommendation — Apply IA-5 to govern credential lifecycle actions tied to joiner and leaver events. | ||
Key terms
- Identity Readiness: Identity readiness is the point at which an organisation can safely grant access to a system, vendor, or workflow because ownership, revocation, and auditability are already defined. In AI-era environments, it includes human and non-human access paths, not just login controls.
- Joiner, Mover, Leaver Workflow: A joiner, mover, leaver workflow is the process that grants, updates, and removes access as a user or identity changes state. In modern programs, the same logic should extend beyond employees to service accounts and AI agents so access does not persist after need ends.
- Lifecycle Visibility: The ability to know which identity or AI system exists, who owns it, what it can access, and how its operating state has changed over time. For AI and other non-human identities, lifecycle visibility must include runtime scope and configuration changes, not just onboarding records.
- Offboarding Symmetry: The principle that the same governed lifecycle used to grant access should also remove it. For identity teams, it means provisioning and revocation are not separate practices but mirrored controls that should be traceable through one record of authority.
What's in the full article
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- How the onboarding dashboard tracks provisioning status across HR, IT, and application owners
- How managers and HR can identify missing access before the employee starts
- How self-service requests route to approvers without manual follow-up
- How the same lifecycle view supports offboarding and access removal
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 20, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org