JML automation exposes the limits of manual identity lifecycle control

At a glance

What this is: This article argues that manual joiner-mover-leaver handling no longer scales because ticket-based lifecycle control leaves onboarding, entitlement changes, and offboarding too slow for modern identity risk.

Why it matters: It matters because IAM, IGA, and PAM teams need lifecycle governance that can keep pace with workforce change, or they will keep exposing standing access and audit gaps across human identity programmes.

By the numbers:

• 80% of cyberattacks leverage identity-based methods, according to CrowdStrike’s 2025 Global Threat Report cited by Lumos.

Context

Joiner-mover-leaver, or JML, is the identity lifecycle process that provisions access for new starters, adjusts permissions when people change roles, and removes access when they leave. The core governance problem is not the workflow itself but the delay and inconsistency that appear when those changes depend on tickets, spreadsheets, and human follow-up.

For IAM and IGA teams, manual JML creates a predictable gap between business change and access change. That gap drives overprovisioning, slows onboarding, extends revocation windows, and makes compliance evidence harder to produce when auditors ask who had access, when, and why.

The article’s primary claim is that lifecycle control has to become policy-driven and event-driven if organisations want least privilege to be meaningful at scale. In that sense, JML automation is an access-governance issue before it is a productivity issue.

Key questions

Q: What breaks when joiner-mover-leaver workflows are mostly manual?

A: Manual workflows create delay, inconsistency, and missed revocations. Access changes arrive late, offboarding becomes dependent on ticket discipline, and audit evidence is fragmented. The result is entitlement creep and a larger attack surface because the organisation cannot prove that access changed when the business event changed.

Q: Why does slow offboarding increase identity risk?

A: Slow offboarding increases risk because former employees can retain access long enough to read data, alter records, or continue using subscriptions after separation. The longer access stays active, the larger the post-exit blast radius becomes. In practice, speed matters because lifecycle delay creates a standing privilege window that should already be closed.

Q: How do you know if JML automation is actually working?

A: JML automation is working when the access outcome matches the lifecycle event across all connected systems, with no unexplained exceptions. Look for fast revocation on leaver events, accurate entitlement updates on mover events, and complete audit logs that show what changed and why. If any of those are missing, the automation is incomplete.

Q: Should organisations prioritise access review or lifecycle automation first?

A: Organisations should prioritise lifecycle automation first when review cycles cannot keep pace with change. Reviews can confirm policy, but automation removes stale access when the underlying event occurs. For high-volume NHIs, that is usually the only practical way to keep entitlements current enough to matter.

Technical breakdown

Why ticket-driven JML creates control lag

Manual JML depends on a service desk noticing a change, creating multiple tickets, routing approvals, and waiting for someone to act. That model breaks because identity state changes faster than human queues can absorb. Onboarding, transfers, and leavers all require different entitlement outcomes, yet tickets treat them as independent tasks instead of one lifecycle with shared policy logic. The result is delayed provisioning, stale access, and inconsistent enforcement across SaaS, on-prem, and hybrid systems.

Practical implication: treat ticket queues as exception handling, not the primary mechanism for lifecycle control.

How policy-based lifecycle orchestration enforces least privilege

Policy-based JML automation ties access decisions to authoritative signals such as HRIS updates, role attributes, department, and termination events. Instead of relying on a person to remember each app and permission, the system applies predefined rules to provision, adjust, or revoke entitlements across the full application estate. That is what turns least privilege from a review-time aspiration into a runtime control. It also reduces entitlement drift because access changes are driven by the same event that changed the business relationship.

Practical implication: anchor JML decisions in authoritative identity and HR signals so access changes happen when the business event occurs.

Why audit readiness depends on entitlement-level visibility

Audit evidence is weak when teams can only show that a ticket existed. Governance requires knowing which entitlements were granted, modified, or removed, and whether the policy behind that decision matched the person’s role at the time. Entitlement-level visibility matters because application-level access is too coarse for meaningful review. Without it, organisations cannot easily prove that access was right-sized or revoked on time, especially in hybrid environments where manual follow-up is harder to verify.

Practical implication: retain entitlement-level records for lifecycle events so reviewers can trace access decisions to policy and timing.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• Ledger Connect Kit npm compromise 2023: Attackers phished a former Ledger employee with unrevoked npm access and published a wallet-draining Connect Kit, stealing about $600k on 14 Dec 2023.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Manual JML is a governance latency problem, not a workflow annoyance. Tickets, spreadsheets, and ad hoc approvals create a gap between business change and access change that modern identity programmes can no longer absorb. When lifecycle action depends on human pacing, least privilege becomes an after-the-fact review exercise instead of an operational control. Practitioners should treat lifecycle latency as a measurable security exposure, not an administrative inconvenience.

Identity lifecycle automation is becoming a baseline expectation for IAM and IGA. The article reflects a broader shift in which onboarding, mover events, and offboarding are governed through policy and authoritative signals rather than manual coordination. That pattern aligns with NIST CSF access permission controls and with lifecycle discipline across human identity programmes. Teams that keep JML as a ticketing process will continue to see privilege creep, delayed deprovisioning, and incomplete audit trails.

Revoke access by event, not by memory, is the right mental model for leavers. Offboarding is where manual lifecycle control fails most visibly because departures are time-sensitive and easy to miss in busy operations. The governance lesson is that access removal has to be bound to the leave event itself, or standing access persists longer than the employment relationship. For practitioners, that means designing offboarding as a control path, not an IT task queue.

JML automation is where human IAM, IGA, and NHI governance start to converge. The same lifecycle logic that governs employees will increasingly be expected for service accounts, tokens, and agentic systems as organisations unify identity operations. The article does not make that leap directly, but it points in that direction by framing lifecycle as a policy engine rather than a human workflow. Teams should prepare for one governance model across all identity types.

Real-time access adjustment is the named concept this article makes unavoidable. The practical issue is not automation for its own sake, but the collapse of acceptable delay between identity change and entitlement change. Once access state must follow business state in real time, manual lifecycle design stops being defensible at scale. Practitioners should re-centre identity programmes on event-driven governance and measurable revocation speed.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: NHI Lifecycle Management Guide

What this signals

Lifecycle control has to move from request handling to event handling. Manual queues cannot keep pace with hybrid work, frequent role changes, or the speed of offboarding. The operational signal to watch is whether identity change events are still waiting on ticket closure before access changes happen, because that delay is where exposure accumulates.

Real-time access adjustment is the governance threshold JML programmes now have to meet. Once access changes are triggered directly from authoritative identity signals, organisations can start measuring revocation speed, entitlement drift, and policy coverage as real control outcomes rather than service metrics.

Access reviews only work well when the underlying lifecycle state is already clean. If mover events and leaver events are not propagated quickly, certification becomes a cleanup exercise rather than a governance control. The better programme design is to reduce the amount of stale access that reaches review in the first place.

For practitioners

• Map every joiner, mover, and leaver event to an authoritative trigger Tie provisioning and revocation to HRIS or IdP events so access changes occur when the employment state changes, not when someone opens a ticket.
• Replace manual offboarding queues with event-driven deprovisioning Design leaver workflows so access removal fires automatically on termination or departure signals across SaaS, on-prem, and cloud systems.
• Define persona-based access bundles for common roles Create role, department, or seniority-based bundles so new starters receive the right baseline access without ad hoc approval chains.
• Track entitlement-level lifecycle records Keep records of which permissions were added, changed, or removed for each lifecycle event so auditors can verify timing and policy alignment.
• Use access exceptions only for edge cases Reserve human review for unusual requests and policy conflicts, not for routine onboarding or routine deprovisioning that can be governed deterministically.

Key takeaways

• Manual JML creates a control lag that shows up as delayed onboarding, stale mover access, and slow offboarding.
• The article ties identity risk to the speed of lifecycle change, with CrowdStrike cited for the finding that 80% of cyberattacks leverage identity-based methods.
• The practical answer is event-driven lifecycle governance that removes access when business state changes, not after someone closes a ticket.

Key terms

• Joiner Mover Leaver: Joiner Mover Leaver is the identity lifecycle process for creating, changing, and removing access as people enter, change roles, or leave an organization. It governs provisioning, modification, and deprovisioning across systems, ensuring access matches current job needs and reducing orphaned accounts, privilege creep, and residual access risk.
• Identity Lifecycle Governance: Identity lifecycle governance is the set of processes that create, change, review, rotate, and revoke access across human and non-human identities. It matters because access risk usually increases when lifecycle events are slow, incomplete, or disconnected from the systems that rely on them.
• Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
• Entitlement-Tied Visibility: Entitlement-tied visibility means a secret can only be viewed by identities that currently hold the relevant access grant. It keeps disclosure aligned with lifecycle state, which is especially important for shared passwords, database credentials, and other ongoing access that should not follow stale distribution lists.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.