Joiner-mover-leaver governance now extends to physical access

At a glance

What this is: NHI Mgmt Group's analysis, drawing on AlertEnterprise's blog post: JML only works as complete identity governance when physical access is governed with the same lifecycle events as digital access.

Why it matters: IAM and IGA teams need to treat badges and facility credentials as part of the same entitlement model, or movers and leavers will keep access after role or employment changes.

Context

Joiner-mover-leaver is the operational link between HR status and access decisions. In this article, the primary governance gap is that identity lifecycle management often stops at applications and cloud entitlements, while physical credentials continue on a separate process with different owners and slower revocation.

That split matters because physical access is still access. If a person can keep a badge after a transfer or termination, the organisation has not completed deprovisioning, it has only completed part of it. The article frames PIAM as the missing layer that brings the physical perimeter into the same lifecycle model as digital identity.

Key questions

Q: What breaks when JML stops at the digital perimeter?

A: A joiner-mover-leaver process that only covers accounts leaves physical credentials outside the lifecycle record. That means a person can change roles or leave the organisation while badges, floor access, or secure-area rights remain active. The practical failure is incomplete deprovisioning, because identity governance has not actually removed all access.

Q: Why does physical access create continued risk after a transfer or termination?

A: Because the access state can diverge from the HR state. If the badge system is updated manually or on a different cadence, movers can keep old rights and leavers can keep entry after their digital access is gone. That creates an avoidable exposure window at the perimeter.

Q: How do organisations know if JML is working across badges and applications?

A: They should measure revocation latency in both domains and compare the badge to the account. If the last physical credential remains active after the leaver event, the programme is only partially automated. The best signal is whether one lifecycle event produces one complete offboarding record.

Q: What is the difference between PIAM and PACS in identity governance?

A: PACS is the door-control layer that decides whether a badge opens a door. PIAM is the governance layer that decides whether the person should still hold that badge at all, based on lifecycle events and access policy. Identity teams need PIAM if they want physical access to follow JML rules.

Technical breakdown

How birthright access maps from HR events to facility credentials

Joiner workflows depend on an authoritative source, usually HR, to create the identity and attach baseline access automatically. In digital environments, that means accounts and entitlements. In physical environments, PIAM extends the same trigger to badges or mobile credentials so the person receives facility access based on role, department, or location. The technical point is not just provisioning speed. It is that a single lifecycle event can drive both systems when the physical access layer is integrated, rather than managed as a separate request queue.

Practical implication: model physical credentials as lifecycle-managed entitlements, not as standalone facilities tickets.

Why mover events are where privilege creep becomes physical

Mover cases expose the weakest part of manual identity governance because transfers usually add new access before old access is removed. In the article, that pattern is described for both application entitlements and facility access, which makes the mover stage a subtract-first problem. If the old unit badge, floor access, or restricted area rights are not removed in the same action as the new role is granted, the identity keeps accumulated access from earlier jobs. That is privilege creep outside the directory.

Practical implication: make transfer workflows remove prior physical access in the same policy transaction that grants new access.

How leaver deprovisioning should close the badge gap

Leaver processing is only complete when every access right disappears at the same time as the employment or engagement ends. The article is explicit that accounts may be disabled quickly while badges remain active for days or weeks, which creates a manual delay window at the physical perimeter. PIAM closes that gap by binding the physical credential to the same offboarding event that disables digital access. That turns badge revocation into an identity action rather than a facilities task.

Practical implication: tie badge deactivation to the same offboarding event that disables accounts and tokens.

Threat narrative

Attacker objective: Retain physical access beyond the identity state that should have removed it, especially after a move or termination.

1. Entry occurs when a joiner, mover, or leaver event is handled on a manual physical-access path instead of through lifecycle automation.
2. Credential access persists because the badge or mobile credential is issued, transferred, or left active outside the HR-driven deprovisioning flow.
3. Escalation happens when the person retains access to previous spaces, units, or secure areas after the role change or termination.
4. Impact is unauthorized continued entry to facilities and the persistence of access that should have ended with the identity event.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

JML is incomplete until it governs physical access. Identity lifecycle is often treated as a directory and application problem, but the article shows that the enterprise still runs a second access system at the door. That creates a split governance model where HR can update digital rights while physical credentials remain on a manual track. The practitioner implication is straightforward: lifecycle governance is only complete when one event governs both the account and the badge.

Physical access creates a privilege-creep problem that audit teams can already recognise. The mover stage is where old facility rights linger, especially when transfer workflows remove digital access but not building access. That is the same governance failure pattern seen in entitlement creep, just with a different control plane. The implication is that physical and logical access reviews should be treated as one governance story, not two unrelated processes.

Contractors expose the weakest assumption in JML design. The article notes that vendors and contractors often join and leave on timelines HR systems do not track well, which makes engagement-bound access the real test of lifecycle governance. The assumption that every identity is employee-shaped breaks here. The implication is that non-employee lifecycle controls must be explicit, time-bound, and tied to engagement end events rather than left to local discretion.

PIAM is the missing governance layer, not a facilities convenience. Physical Identity and Access Management sits between the lifecycle event and the door controller, deciding whether a person should still hold the credential at all. That makes it a governance function above the PACS, not an accessory to it. The implication is that identity teams should treat physical credential issuance and revocation as part of the same control domain as accounts and entitlements.

One lifecycle record should produce one audit story. The article makes clear that the value of unified JML is not only automation, but also evidence that revocation happened across both domains. When manager review, access certification, and deprovisioning all reference the same lifecycle event, auditability improves materially. The implication is that identity programmes should align evidence generation across HR, IAM, and physical access instead of proving each in isolation.

What this signals

Physical access is the last common exception in otherwise automated lifecycle programmes. Most identity teams have already proved they can drive digital provisioning from authoritative HR data. The next maturity step is to make the physical credential behave like any other governed entitlement, so the badge is no longer exempt from the same join, move, and leave logic.

JML governance becomes materially stronger when evidence is unified. When the lifecycle event, the account change, and the facility revocation all point to the same record, audit effort falls and control confidence rises. That is the difference between a partial identity programme and one that actually closes the loop on access removal.

Non-employee access remains the hardest gap to govern. Contractors and vendors often move through the organisation on timelines and ownership models that do not fit standard employee workflows. Programmes that bind physical and digital access to engagement end dates will be better positioned to reduce lingering access without adding manual review load.

For practitioners

• Make HR the single lifecycle trigger Route hire, transfer, and termination events from one authoritative source so digital and physical access respond to the same record.
• Extend birthright access into physical credentials Define role-based facility access before automation so joiner events can issue the right badge or mobile credential on day one.
• Design mover workflows to subtract first Remove prior building, floor, or unit access in the same transfer action that grants the new role’s access.
• Tie leaver deactivation to offboarding events Deactivate badges and mobile credentials through the same workflow that disables digital accounts and other credentials.
• Measure revocation latency across both domains Track the time between the leaver event and the last active access right, including badges, to expose any manual delay window.

Key takeaways

• Joiner-mover-leaver governance does not reach full effectiveness until it covers badges, facilities, and other physical credentials as part of the same lifecycle model.
• The central risk is not provisioning speed but incomplete revocation, especially when movers retain old access and leavers keep entry rights after digital access has been removed.
• Unifying HR events, IAM workflows, and physical access revocation is the control that turns JML from a directory process into complete identity governance.

Key terms

• Joiner Mover Leaver: Joiner Mover Leaver is the identity lifecycle process for creating, changing, and removing access as people enter, change roles, or leave an organization. It governs provisioning, modification, and deprovisioning across systems, ensuring access matches current job needs and reducing orphaned accounts, privilege creep, and residual access risk.
• Physical Identity And Access Management: PIAM is the governance layer that connects HR, identity, and physical security systems so access decisions follow one lifecycle model. It aligns badge issuance, revocation, certification, and policy enforcement across facilities, contractors, and employees, reducing the gaps that appear when physical access is managed separately from digital identity.
• Birthright Access: The baseline set of entitlements that a user should receive by default because of role, department, or another stable attribute. It is a governance construct, not a blanket permission model. The control challenge is proving that the baseline stays current as jobs, applications, and ownership change.
• Deprovisioning: Deprovisioning is the removal of access when a user changes roles or leaves an organisation. For security teams, it is the point where stale accounts, tokens, and permissions should disappear. Weak deprovisioning leaves residual access that can outlive the business need that created it.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.