TL;DR: Manual employee lifecycle management still forces IT teams to jump between tabs, raise tickets, and revoke access by hand, increasing errors and delay across onboarding, mid-life changes, and offboarding, according to Zluri. That gap matters because access governance fails when revocation and modification depend on human speed rather than policy-driven lifecycle controls.
At a glance
What this is: This is a lifecycle management article showing that manual onboarding, mid-life access changes, and offboarding create governance gaps when IT teams rely on spreadsheets, tickets, and tab-hopping.
Why it matters: It matters because IAM programmes fail when access changes are slower than business change, leaving SaaS permissions, approvals, and revocation exposed to delay and error.
Context
Lifecycle management is the process of granting, changing, and removing access as people move through joiner, mover, and leaver stages. In this article, the security gap is not identity proofing or authentication itself, but the operational gap between a lifecycle decision and the actual entitlement change across SaaS apps.
The article argues that manual workflows make access governance brittle because IT teams must raise tickets, switch between tools, and handle revocation by hand. That is a familiar failure mode in IAM programmes that still treat lifecycle events as isolated tasks instead of governed processes.
Key questions
Q: What breaks when lifecycle management is still manual?
A: Manual lifecycle management creates delays between a business event and the identity update that should follow it. New hires wait for access, movers accumulate old permissions, and leavers keep credentials longer than they should. The result is predictable drift, avoidable audit issues, and higher security exposure.
Q: Why do access governance failures often show up first in offboarding?
A: Offboarding exposes governance failure because it forces teams to remove access everywhere at once. If the process is manual, hidden, or fragmented across apps, some permissions survive after employment ends or roles change. That leftover access is a control failure because it leaves active entitlements in place after accountability should have ended.
Q: How do you know automated lifecycle controls are actually working?
A: Look for evidence that access changes are timely, complete, and auditable across onboarding, moves, and terminations. If accounts linger after separation, exceptions are common, or revocation records are incomplete, the control is failing. The metric that matters most is whether the access state matches the business state without manual chasing.
Q: What should IAM teams do when access spans multiple SaaS sessions and federated apps?
A: They should require session lineage, not just account inventory. If one identity can hold several app sessions at once, teams need to know how those sessions relate, which grants they inherit, and which control point can terminate them all at once. Otherwise, the incident response path is fragmented by design.
Technical breakdown
Why manual provisioning creates access drift
Manual provisioning turns lifecycle events into a sequence of human actions across tickets, app consoles, and spreadsheets. Each extra handoff increases the chance that access is granted late, granted incorrectly, or never removed. In IAM terms, the entitlement state in the target application stops matching the authoritative record, so governance becomes retrospective rather than enforced at change time.
Practical implication: replace manual joiner and mover handling with policy-driven provisioning that updates entitlements at the moment of the lifecycle event.
Why offboarding is the highest-risk lifecycle step
Offboarding is the point where governance failure becomes immediately visible because access should end, not merely pause. If revocation depends on a person remembering every app and account, ex-employees can retain access long after departure. The article also points to wasted SaaS spend, which is a useful reminder that stale access creates both security exposure and licence inefficiency.
Practical implication: treat offboarding as a controlled revocation workflow with explicit account deactivation and access removal checkpoints.
How centralized SaaS visibility changes lifecycle control
A single dashboard for access permissions does not solve governance by itself, but it changes the control surface. It makes it easier to see which apps are attached to which users, which workflows completed, and where a lifecycle action failed. That visibility matters because lifecycle control is only as strong as the organisation’s ability to verify that the intended access change actually reached every downstream application.
Practical implication: build lifecycle operations around authoritative visibility into app entitlements, workflow status, and completion exceptions.
Threat narrative
Attacker objective: The practical attacker outcome is lingering access to SaaS data and accounts after governance should have removed it.
- Entry occurs when a routine lifecycle change, such as onboarding or departure, is handled manually across multiple SaaS applications.
- Escalation appears as delayed or incomplete entitlement updates leave users with access they should no longer have, or without access they should have received.
- Impact follows when stale access persists, increasing the chance of unauthorised data exposure and unnecessary SaaS licence consumption.
Breaches seen in the wild
- Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
- Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Lifecycle governance fails when access change is treated as a ticketing problem rather than an entitlement-state problem: The article shows that manual tab-switching, ticket queues, and spreadsheet handling slow the actual change that matters, which is the access state inside each application. That delay creates the real governance gap because policy intent and system reality diverge. Practitioners should read this as a control design issue, not a workflow inconvenience.
Offboarding is the point where stale access becomes measurable risk, not a theoretical one: When departure handling is manual, the organisation is relying on memory to remove every entitlement, account, and licence. That is a weak control assumption for SaaS-heavy estates where one missed revocation is enough to preserve data access. The implication is that leaver processing needs to be governed as a complete revocation state, not a best-effort task.
Access visibility is the prerequisite for lifecycle assurance, not a reporting convenience: A central view of SaaS permissions, workflow status, and exceptions changes whether lifecycle teams can prove that grants and removals actually happened. Without that visibility, recertification and offboarding both become delayed recognition exercises. For IAM leads, the key question is whether the lifecycle system can demonstrate completion across the downstream app estate.
Lifecycle management is now a core identity governance discipline across SaaS estates: The article reflects a broader market reality that joiner, mover, and leaver controls are becoming inseparable from SaaS governance. As application sprawl grows, the governing problem is no longer whether a workflow exists, but whether it reliably reaches every identity-bearing app. That is where identity governance either holds or fails.
What this signals
Lifecycle governance now sits at the centre of SaaS access control: As application estates expand, the practical question is no longer whether joiner, mover, and leaver processes exist, but whether they reliably change entitlements in every downstream system. Teams should expect more governance failures to appear as missed revocations or incomplete access changes, not as dramatic policy breaches.
Authoritative workflow status is becoming a control requirement: IAM teams need proof that a lifecycle action completed, failed, or is still pending. Without that evidence, revocation and provisioning become assumptions rather than governed outcomes, which weakens both auditability and operational trust in the access programme.
For practitioners
- Standardise joiner, mover, and leaver workflows Define one governed workflow per common lifecycle event and reuse it across employee groups so access changes are applied consistently.
- Automate entitlement removal on departure Make account deactivation and application revocation part of the offboarding workflow, with explicit completion status for each target application.
- Map every SaaS app to an authoritative owner Tie each application to an accountable owner so lifecycle actions have a clear decision path when a grant or revoke fails.
- Track failed lifecycle runs as governance exceptions Review recent run or workflow status records to identify where provisioning, modification, or revocation did not complete.
Key takeaways
- Manual lifecycle management creates governance drift because access changes are still mediated by human tasks instead of policy-enforced workflows.
- The highest-risk failure is incomplete offboarding, where former users can retain SaaS access and continue to consume licences.
- The practical control lesson is to centralise entitlement visibility and automate grant, change, and revoke actions across the application estate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Manual offboarding leaves access active after departure, which is the article's clearest control gap. |
| NHI-05 — Overprivileged NHI | The article centers on lingering access and mismatched permissions across SaaS apps. | |
| Recommendation — Automate offboarding to remove every account and entitlement when employment ends. Review assigned entitlements regularly and remove access that exceeds role needs. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Lifecycle workflows should ensure users only keep access needed for their current role. |
| Recommendation — Apply least-privilege controls to reduce access during role changes and offboarding. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing entitlements across onboarding, change, and exit events. |
| Recommendation — Govern permissions centrally and verify that entitlement changes propagate to each application. | ||
| CIS Controls v8 | CIS-5 — Account Management | Lifecycle handling is fundamentally about creating, modifying, and removing accounts on time. |
| Recommendation — Maintain account records and revoke access promptly when users change roles or leave. | ||
Key terms
- Lifecycle Management: Lifecycle management is the process of creating, reviewing, rotating, and retiring identities and their secrets in a controlled way. For NHIs, it is essential because stale credentials, orphaned accounts, and incomplete offboarding are common paths to long-lived exposure and unauthorised access.
- Offboarding Workflow Automation: Offboarding workflow automation uses systems and rules to coordinate termination tasks across HR, IT, and security. It can trigger notifications, revoke access, track progress, and record evidence without relying on manual follow-up. The goal is consistent execution, faster completion, and stronger compliance documentation across every employee exit.
- Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.
- Authoritative Access View: An authoritative access view is a central record of which identities hold which permissions across applications. It matters because lifecycle governance cannot be trusted unless teams can see grants, changes, failures, and revocations in one place and confirm completion in the systems that enforce access.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org