Identity lifecycle management is failing where JML stays siloed

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Oleria Security's blog post: Siloed joiner, mover and leaver processes create access sprawl, incomplete offboarding and audit gaps in identity lifecycle management and JML automation.

Why it matters: It matters because IAM, IGA, PAM and NHI programmes all depend on a governed lifecycle, and fragmented JML leaves human and non-human access outside defensible control.

By the numbers:

• Over 95% of multi-cloud permissions remain unused, increasing risk without providing any business benefit.
• Only 42% of enterprises have deployed standard IGA tools, well below firewalls, email security and SIEM tools.
• Firewalls are deployed in 83% of enterprises, according to the article’s comparison of common security controls.
• Email security is deployed in 74% of enterprises, according to the article’s comparison of common security controls.

Context

Identity lifecycle management is the governance layer that controls how access is granted, changed and removed across an identity’s lifetime. In this article, the problem is not the JML model itself but the way many organisations still run it as separate joiner, mover and leaver workflows instead of one governed lifecycle.

That fragmentation matters for both human users and non-human identities. The article explicitly extends lifecycle management to API tokens, service accounts and agentic AI tools, which means offboarding, role change control and audit evidence all need to work across multiple identity types, not just employees.

Key questions

Q: What breaks when joiner-mover-leaver workflows are mostly manual?

A: Manual workflows create delay, inconsistency, and missed revocations. Access changes arrive late, offboarding becomes dependent on ticket discipline, and audit evidence is fragmented. The result is entitlement creep and a larger attack surface because the organisation cannot prove that access changed when the business event changed.

Q: Why do unused permissions become a security risk in JML programmes?

A: Unused permissions still expand the attack surface and create standing access that attackers can abuse if an account is compromised. They also make access reviews less meaningful because the control is judging a stale permission set rather than active business need.

Q: How do organisations know offboarding is actually complete?

A: They know offboarding is complete when the revocation checklist is built from current entitlements, not from an old spreadsheet or onboarding record. Completion should be confirmed against live access data across apps, directories, and privileged systems. If the workflow cannot prove removal, the account is not fully offboarded.

Q: What is the difference between workflow automation and lifecycle governance?

A: Workflow automation moves tasks between systems, while lifecycle governance decides whether the right identity state changes should happen at all. A platform can automate a process without proving that the process is accurate, auditable, or aligned to current business ownership.

Technical breakdown

Why siloed JML creates access drift

Joiner, mover and leaver controls only work when they share the same identity state and policy logic. If onboarding lives in HR ticketing, transfers sit in a separate approval path and offboarding depends on manual follow-up, each phase accumulates its own version of truth. That creates access drift: users keep old permissions, new permissions stack on top, and revocation becomes partial rather than complete. The article’s point is that lifecycle control fails when it is treated as a sequence of disconnected tasks instead of one continuous governance system.

Practical implication: unify identity data and workflow state before trying to automate individual JML steps.

How unused permissions become lifecycle risk

The article ties lifecycle failure to unused permissions because standing access that nobody uses still expands attack surface and audit scope. In mature JML design, onboarding should provision only what role context justifies, mover events should remove legacy access instead of merely adding new entitlements, and leaver events should eliminate orphaned access across all connected systems. Where those controls are missing, dormant access persists long after business need has ended. That is why access sprawl is not just inefficiency; it is a governance failure with security consequences.

Practical implication: measure entitlement usage and treat dormant access as a lifecycle defect, not an acceptable by-product.

Why offboarding must include post-departure monitoring

Offboarding is rarely complete at the moment a primary account is disabled. The article highlights secondary systems, shared drives, email lists and machine tokens as common places where residual access survives after a termination event. Post-departure monitoring is therefore not an optional embellishment; it is the mechanism that confirms revocation actually propagated. Without that confirmation loop, an organisation can believe leaver controls succeeded while secondary access remains live in another plane. That gap is especially important where non-human identities are involved, because tokens and service accounts often outlive the human workflow that created them.

Practical implication: verify revocation across downstream systems and monitor for reactivation or lingering access after offboarding.

Threat narrative

Attacker objective: The attacker seeks durable access through identities whose permissions outlive business need and offboarding completeness.

1. Entry occurs when joiner workflows provision more access than a role needs, giving identities an unnecessarily broad starting surface.
2. Escalation occurs as mover processes fail to remove legacy permissions, allowing privilege accumulation across role changes.
3. Impact follows when leaver workflows miss secondary systems, leaving orphaned accounts, dormant permissions or residual tokens available for misuse.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity lifecycle governance fails when joiner, mover and leaver are managed as separate administrative events rather than one control system. The article’s core problem is not lack of policy, but broken continuity between provisioning, change and deprovisioning. Once those stages are split across tools and teams, audit evidence fragments and access decisions lose context. The practitioner conclusion is simple: lifecycle governance has to be treated as a single state model, not three disconnected queues.

Standing access after role change is a permission-creep problem, not a reporting problem. The article makes clear that mover workflows are where entitlement accumulation quietly becomes normal. That is the point at which access reviews often become rubber-stamped because reviewers see old permissions but not whether they are still needed. The field should stop treating mover cleanup as optional hygiene and recognise it as the control that prevents lifetime privilege growth.

Post-departure visibility is the named concept this article sharpens. Offboarding is not complete when a primary account is disabled, because downstream systems can retain shared access, tokens or secondary entitlements. That assumption breaks the moment lifecycle governance spans SaaS, cloud and machine credentials. The implication is that practitioners must design for confirmation of revocation, not just initiation of revocation.

NHI lifecycle management is now inseparable from human JML governance. The article explicitly includes API tokens, service accounts and agentic AI tools in the lifecycle model, which means the old boundary between workforce offboarding and machine credential governance no longer holds. Identity programmes that still route these through different control owners will keep producing incomplete revocation and weak accountability. The practitioner conclusion is to govern all actor types through one lifecycle discipline.

Unified audit trails are becoming the real test of lifecycle maturity. The article shows that scattered ticketing records do not prove access was actually removed or updated across all systems. What matters now is whether an organisation can reconstruct who had what, when it changed and how revocation was verified. The implication for the field is that evidence quality, not just workflow automation, defines defensible JML governance.

What this signals

Post-departure visibility: lifecycle teams should stop treating offboarding as a single event and instead design for confirmation that revocation reached every downstream system. That shift matters because secondary access paths are where residual risk survives after the primary account is closed.

Ticketing can record intent, but it cannot prove entitlement state across SaaS, cloud and machine credentials. Practitioners should watch for programmes that still rely on manual closure evidence, because those workflows tend to miss dormant access and create brittle audit narratives.

For practitioners

• Consolidate identity state into one lifecycle view Map HR, identity provider, SaaS, cloud and application records into a single workflow state so joiner, mover and leaver events reference the same source of truth.
• Automate mover cleanup for legacy permissions Remove previous role entitlements when a person changes position, instead of layering new access on top of old access that may never be used again.
• Verify leaver revocation across downstream systems Check shared drives, email groups, VPNs, third-party apps and machine tokens after termination so hidden access does not survive primary deprovisioning.
• Measure access bundle drift regularly Compare current entitlements to role-based bundles and usage patterns to identify access that has become stale, excessive or disconnected from business need.
• Retain post-departure monitoring for reactivation signals Keep a short monitoring window after offboarding to detect account reactivation, lingering tokens or delayed sync events that would otherwise leave residual access unnoticed.

Key takeaways

• Siloed JML creates access drift because joiner, mover and leaver controls stop sharing one entitlement state.
• The article shows that unused permissions, incomplete offboarding and fragmented audit evidence are the practical symptoms of that drift.
• The strongest control response is unified lifecycle governance with verified revocation across downstream systems and machine credentials.

Key terms

• Identity Lifecycle Governance: Identity lifecycle governance is the set of processes that create, change, review, rotate, and revoke access across human and non-human identities. It matters because access risk usually increases when lifecycle events are slow, incomplete, or disconnected from the systems that rely on them.
• Joiner Mover Leaver: Joiner Mover Leaver is the identity lifecycle process for creating, changing, and removing access as people enter, change roles, or leave an organization. It governs provisioning, modification, and deprovisioning across systems, ensuring access matches current job needs and reducing orphaned accounts, privilege creep, and residual access risk.
• Access Sprawl: The gradual accumulation of permissions across users, services, and integrations until no one can easily explain why access still exists. In NHI environments, it often appears when machine identities keep inherited rights long after their original business purpose has changed.
• Post-Departure Monitoring: Post-departure monitoring is the practice of checking for residual access after an identity has been offboarded. It is especially important when credentials, tokens or delegated access can remain active in connected systems after the primary account is disabled.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.