TL;DR: C1.ai says manual joiner-mover-leaver handling still creates onboarding delays, misassigned access, and offboarding gaps across dozens of systems. Automating identity lifecycle management turns those events into policy-driven workflows, but the governance problem becomes keeping roles, reviewers, and audit trails aligned as work changes.
At a glance
What this is: This is a blog post about automating identity lifecycle management, with the key finding that manual JML handling creates delays, access errors, and offboarding gaps.
Why it matters: It matters because IAM, IGA, and PAM teams need lifecycle controls that keep access aligned to roles and departures across many systems without relying on manual cleanup.
👉 Read C1.ai's blog on automating identity lifecycle management
Context
Identity lifecycle management covers the changes that happen as people join, move, leave, or enter temporary status changes in an organisation. In this post, C1.ai argues that those transitions become risky when they depend on manual ticket handling across many connected systems.
The governance gap is not simply speed. It is whether access changes, reviews, and removals stay aligned to policy as roles, managers, and job functions change. That is the core ILM problem for human IAM programmes, especially where provisioning and deprovisioning must be consistent across directories, applications, and review workflows.
Key questions
Q: What breaks when joiner-mover-leaver workflows are mostly manual?
A: Manual workflows create delay, inconsistency, and missed revocations. Access changes arrive late, offboarding becomes dependent on ticket discipline, and audit evidence is fragmented. The result is entitlement creep and a larger attack surface because the organisation cannot prove that access changed when the business event changed.
Q: What is the difference between lifecycle automation and identity governance?
A: Lifecycle automation is the mechanism that carries out identity changes quickly, while identity governance is the control layer that decides what should happen and verifies it happened correctly. Automation without governance can accelerate mistakes. Governance without automation can leave access changes too slow to be safe.
Q: How do organisations know automated ILM is actually working?
A: Automated ILM is working when lifecycle events produce the right access outcome, on time, with a complete evidence trail. Look for fewer manual tickets, shorter provisioning and removal delays, fewer stale permissions after role changes, and logs that show who changed what and why. If those signals are missing, the workflow may be automated but not governed.
Q: Who is accountable for lifecycle rules when identity changes are automated?
A: Accountability stays with the organisation that defines the lifecycle policy, not with the automation itself. IAM, HR, application, and review owners need clear responsibility for triggers, exceptions, and approvals because automation only executes the rules it is given. If ownership is unclear, the workflow can be fast and still be wrong.
Technical breakdown
Why manual JML workflows break down at scale
Joiner-mover-leaver processes depend on timely decisions, consistent routing, and clean handoffs across systems. When those steps are manual, delays and exceptions accumulate, which creates mismatched access, stale permissions, and missed offboarding. Identity lifecycle management is not just account creation or deletion. It also includes role changes, temporary leave, review triggers, and entitlement cleanup. The more systems and approvers involved, the more likely the process drifts away from policy and creates audit noise.
Practical implication: replace hand-built lifecycle steps with governed workflows wherever the same change logic repeats across systems.
How policy-driven automation changes provisioning and revocation
A workflow builder turns lifecycle events into if/then logic. A hire date, title change, manager change, or termination event can trigger account creation, access removal, review routing, or account closure. The technical difference is that the control point moves from after-the-fact cleanup to event-driven execution tied to the source of truth. That reduces time between business change and access correction, provided the logic is tightly scoped and the triggering data is reliable.
Practical implication: bind lifecycle actions to authoritative HR and identity events so access changes happen at the same moment the business state changes.
Why auditability is part of lifecycle design, not a side effect
Automated ILM only works as governance if the workflow is traceable. Every grant, removal, delay, approval, and exception needs to be logged in a way that supports review and investigation. In practice, that means lifecycle automation has to preserve reviewer identity, timing, policy basis, and final outcome. Without that metadata, automation may reduce ticket volume but still leave the organisation unable to explain why access existed or why a removal was delayed.
Practical implication: treat lifecycle logging and review evidence as mandatory design requirements for every automated JML workflow.
Breaches seen in the wild
- Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
- Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Manual lifecycle governance was designed for slower identity change than modern enterprises now tolerate. The article shows that joiner-mover-leaver handling breaks when people move between roles, departments, and employment states faster than tickets can keep up. That is not just an efficiency issue. It is a governance mismatch between business change and access change, and it leaves access drift as a structural outcome rather than a rare exception. Practitioners should treat lifecycle latency as a control failure, not an administrative inconvenience.
Identity lifecycle automation shifts the control boundary from fulfilment to policy design. Once lifecycle events are automated, the real question becomes whether the rules reflect how the organisation actually grants, revises, and removes access. The post is explicit that teams need conditional logic, source-system integration, and reviewer routing. That means governance quality depends on the accuracy of the policy model, not on whether humans can remember to close the loop. The practitioner implication is that lifecycle design becomes part of access governance architecture.
Auditability is only real when workflow evidence survives the automated transition. If access is granted or revoked automatically but the organisation cannot reconstruct the decision path, automation has reduced effort without improving governance clarity. The article points to logging, traceability, and central visibility as part of the value. That aligns with a simple identity governance principle: fast controls still need explainable controls. Practitioners should ensure every lifecycle action leaves evidence fit for review, exception handling, and compliance testing.
Named concept: lifecycle policy drift. As organisations add different rules for hires, movers, leave cases, and terminations, the risk is that the workflow diverges from the actual policy over time. This is not a tooling problem by itself. It is a governance problem where the process no longer matches the employment state it is supposed to govern. The implication is that teams need to monitor whether the automation still reflects current business rules, not just whether it runs.
Automated ILM validates the move from ticket-based control to event-based control, but it also raises the bar for lifecycle ownership. Someone must own the policy logic, the triggers, the exceptions, and the review routing. Otherwise automation simply hardens a flawed manual process at greater speed. For IAM and IGA teams, that means lifecycle ownership has to be explicit, documented, and tested against real role and departure scenarios.
What this signals
Lifecycle policy drift: As automation expands, the risk is that exception paths, role-specific rules, and reviewer routing diverge from the actual employment model they were meant to enforce. That creates a governance gap where workflow design must be reviewed as carefully as entitlements themselves.
Identity lifecycle automation shifts control from manual fulfilment to policy quality, which means IAM and IGA teams must own the logic behind every hire, move, leave, and termination path. If the rule set is stale or inconsistent, the automation only makes the error faster.
Access reviews, revocations, and temporary suspensions all need evidence that survives the workflow. Without traceable triggers and logged outcomes, automation may reduce operational load while leaving compliance and audit questions unanswered.
For practitioners
- Define lifecycle events as governed triggers Map hires, role changes, manager changes, leaves, and terminations to specific identity actions so each business event has a deterministic access outcome.
- Connect automation to authoritative sources Use HR systems, directories, identity providers, and applications as trusted inputs so provisioning and revocation follow the current employment state.
- Route reviews on attribute change Trigger access reviews when department, title, or manager changes occur, and send them to reviewers who actually own the affected entitlements.
- Log every lifecycle action end to end Capture who approved, what rule fired, which access changed, and when the action completed so audit trails remain usable after automation.
- Test offboarding as a timed workflow Verify that termination removes directory access, group membership, and related permissions immediately or after a documented delay, with no manual cleanup dependency.
Key takeaways
- Manual lifecycle handling remains a common source of access drift because business changes outpace human ticketing.
- Policy-driven automation can reduce delays, but only if triggers, reviewers, and source systems stay aligned with current roles.
- Governance quality now depends on lifecycle policy design, audit evidence, and explicit ownership of automated access decisions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Lifecycle automation in this article is fundamentally about keeping access aligned to current entitlements. |
| GV.PO-01 — Policy | The workflow builder only works when lifecycle rules are defined as policy, not ad hoc practice. | |
| Recommendation — Map lifecycle workflows to PR.AA-05 so grants, removals, and reviews stay aligned with authorised access. Document lifecycle policy rules so automation executes approved access decisions rather than informal practice. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | The post focuses on automated account creation, role changes, suspension, and termination handling. |
| IA-5 — Authenticator Management | Credential issuance and revocation are part of the lifecycle transitions discussed in the article. | |
| Recommendation — Use AC-2 to govern account provisioning, disablement, and termination across automated JML processes. Apply IA-5 to control credential issuance and revocation as identities move through lifecycle states. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article is centered on lifecycle-driven account creation, removal, and entitlement maintenance. |
| Recommendation — Implement CIS-5 to standardise account lifecycle handling and reduce manual cleanup across systems. | ||
Key terms
- Identity Lifecycle Governance: Identity lifecycle governance is the set of processes that create, change, review, rotate, and revoke access across human and non-human identities. It matters because access risk usually increases when lifecycle events are slow, incomplete, or disconnected from the systems that rely on them.
- Joiner Mover Leaver: Joiner Mover Leaver is the identity lifecycle process for creating, changing, and removing access as people enter, change roles, or leave an organization. It governs provisioning, modification, and deprovisioning across systems, ensuring access matches current job needs and reducing orphaned accounts, privilege creep, and residual access risk.
- Policy-Driven Workflow: A policy-driven workflow is an automated sequence that executes access actions based on predefined business rules. It reduces manual handling, but its governance value depends on whether the logic matches current roles, approvers, and exception conditions.
- Access Review Trigger: An access review trigger is the event or condition that starts a validation of current entitlements. Common triggers include manager changes, title changes, department changes, or termination events, and the review must route to the right decision owner.
What's in the full article
C1.ai's full blog covers the operational detail this post intentionally leaves for the source:
- Example workflow logic for hires, movers, leaves, and terminations using if/then automation
- Specific lifecycle use cases such as dynamic group updates, access reviews, and final account removal
- Guidance on integrating HR systems, identity providers, directories, and applications as event sources
- Operational examples of audit logging, time-based logic, and reviewer routing in JML workflows
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 8, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org