TL;DR: Only 8% of companies have fully automated provisioning while 70% still rely on manual joiner-mover-leaver operations, according to READI research, leaving legacy apps, cloud terminations and non-account workflows exposed to slow handoffs and hidden exceptions. Manual orchestration turns identity governance into a partial control that misses the operational state practitioners need to manage.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on READI's blog post: Manual joiner-mover-leaver workflows still leave provisioning gaps, delayed terminations and invisible exceptions across identity operations.
Why it matters: Identity teams need to treat lifecycle orchestration as an operational control problem, because partial automation can still leave access, devices and downstream tasks unmanaged after HR events.
Context
Identity governance fails when lifecycle events are treated as fully automated in one system but still depend on manual work in the systems that actually matter. The core gap is not the HR trigger itself, but the handoff between governance intent and execution across legacy applications, cloud services and non-account tasks.
When provisioning, deprovisioning and related operational tasks remain split across tools and service desk queues, the organisation loses visibility into state, exceptions and completion. That makes joiner-mover-leaver governance look complete on paper while leaving real-world access and operational dependencies unresolved.
Key questions
Q: What breaks when joiner-mover-leaver workflows are mostly manual?
A: Manual workflows create delay, inconsistency, and missed revocations. Access changes arrive late, offboarding becomes dependent on ticket discipline, and audit evidence is fragmented. The result is entitlement creep and a larger attack surface because the organisation cannot prove that access changed when the business event changed.
Q: Why do delayed offboarding processes create security risk?
A: Delayed offboarding creates security risk because access can remain active after the business relationship ends. Former users may still reach email, files, CRM, or admin tools, which expands the window for data theft or disruption. The issue is not the departure itself, but the period during which stale access still works.
Q: How do manual connector gaps affect identity governance?
A: Manual connector gaps force identity governance teams to manage accounts, entitlements and lifecycle events outside automated provisioning and reconciliation. That leaves service accounts, API keys, certificates and local accounts dependent on spreadsheets, tickets or scripts, which increases orphaned access, delayed deprovisioning and inaccurate access reviews. The usual control is a manual attestation and exception process until a proper connector can synchronise source and target systems.
Q: What should teams do when onboarding tasks fall outside IAM?
A: Teams should route those tasks to the owning operational process, with clear control ownership, evidence capture and an exception path back into IAM where access is involved. For example, device setup, software installation and hardware fulfilment can sit in onboarding workflows, while account creation, MFA enrolment and privileged access requests remain under IAM. That separation avoids confusing identity administration with general IT fulfilment.
Technical breakdown
Why lifecycle automation breaks at the connector boundary
Lifecycle automation usually works well where the target system has a native connector, a predictable workflow and a clear account model. It breaks when the application is legacy, specialised or only partially supported, because the identity platform can issue a request but not complete the action end to end. In those cases, the workflow becomes a ticketing chain rather than an entitlement change. The practical problem is not only delay. It is that the governance state inside the IGA tool no longer matches the operational state in the downstream system.
Practical implication: Treat every manual connector handoff as a control failure point and inventory which systems still depend on human fulfilment.
How termination risk persists after the HR event
Termination is the clearest example of how identity governance can fail when deprovisioning is not truly immediate. If access removal depends on manual follow-up, the user can retain access to cloud apps, collaboration tools or legacy systems long after the employment change has occurred. SSO reduces this risk only when it is actually the enforcement point for the application. Where it is not, the residual access window becomes an attacker opportunity and an insider risk at the same time. See the Joiner-Mover-Leaver (JML) Guide.
Practical implication: Map every termination path to the actual access removal point, not to the HR notification that starts the workflow.
Why non-account processes matter to identity governance
Identity programmes often focus on accounts, roles and entitlements, but many business-critical onboarding tasks sit outside that scope. Badge issuance, phone assignment, laptop provisioning and similar steps are not entitlements in the strict IAM sense, yet they shape whether a worker can operate securely and productively from day one. When those processes stay manual, the organisation creates avoidable exceptions and loses a reliable view of start-of-employment readiness. That weakens both user experience and operational resilience.
Practical implication: Bring adjacent onboarding dependencies into the same governance view so the programme measures readiness, not just account creation.
Threat narrative
Attacker objective: The objective is to exploit the post-exit access window before manual offboarding catches up.
- Entry occurs through an HR-driven joiner, mover or leaver event that starts the identity workflow.
- Credential or access removal is delayed when downstream systems rely on manual ticket fulfilment instead of direct deprovisioning.
- Escalation happens when lingering access survives the change event and the organisation cannot see or close the exception quickly.
- Impact is delayed termination, exposed business data and avoidable operational disruption while access remains open.
Breaches seen in the wild
- Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
- Ledger Connect Kit npm compromise 2023: Attackers phished a former Ledger employee with unrevoked npm access and published a wallet-draining Connect Kit, stealing about $600k on 14 Dec 2023.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Joiner-mover-leaver automation is only as strong as the least automated downstream step. READI's framing shows a common governance illusion: the IGA layer can look complete while service desk queues, legacy interfaces and operational tasks still require manual fulfilment. That means the programme measures workflow initiation more reliably than workflow completion. Practitioners should judge lifecycle maturity by the slowest handoff, not the best-integrated system.
Manual termination handoffs create an access persistence window that governance dashboards hide. When a leaver event depends on tickets, local system owners and delayed follow-up, removal happens after the risk event, not at it. That is not a minor process defect, it is a control boundary failure across IAM, SSO and downstream application ownership. The implication is that termination governance must be evaluated by residual access duration, not by whether the HR event fired.
Non-account lifecycle work is part of identity governance, even when teams exclude it from IGA metrics. Badge, phone and device provisioning shape whether a user can work securely on day one, and those tasks often sit outside the automation model. This creates a false sense of completeness because the access review may pass while the operational onboarding still fails. Identity programmes should treat these dependencies as governance scope, not service desk trivia.
The named concept here is lifecycle visibility debt: organisations accumulate it when identity orchestration is measured inside the IGA tool but not across the full operational chain. That debt hides exceptions until business impact appears, which is why hiring managers and HR often see the failure before identity teams do. The practical conclusion is that lifecycle governance must surface completion state across all linked processes, not just approval state.
What this signals
Lifecycle governance needs a completion model, not just a request model. When identity operations are measured only at the point where an HR event is created, programmes miss the real control question: did access, devices and adjacent services actually change? The next maturity step is to treat workflow completion, exception state and downstream ownership as first-class governance data.
Lifecycle visibility debt: this is what builds up when a programme can see that a request was raised but cannot see whether the final state across applications, devices and service desk queues is correct. The result is predictable, because exceptions stay hidden until business users feel them. Identity teams should prepare to govern the full operational chain, not just the automation layer.
For practitioners
- Map every manual handoff in lifecycle workflows Identify where provisioning, deprovisioning or adjacent onboarding tasks leave the identity platform and become tickets, emails or local fulfilment steps. Read NHI lifecycle automation.
- Measure termination by residual access time Track how long ex-employees or moved users retain access in each downstream system after the triggering HR event, especially cloud apps without direct enforcement. See the Joiner-Mover-Leaver (JML) Guide.
- Extend governance to non-account onboarding tasks Bring device, badge and phone readiness into the same operational view so exceptions are visible before the first day of work.
- Prioritise connectors for high-friction applications Focus automation effort on legacy and specialised systems that still depend on service desk fulfilment because they are the most persistent source of manual drift.
Key takeaways
- Manual lifecycle workflows create hidden control gaps because governance stops at the request and not at the final state.
- The risk is not abstract: delayed deprovisioning leaves access open after termination, which is exactly when programmes need control to be strongest.
- Practitioners should focus on residual access, connector coverage and exception visibility before treating lifecycle automation as complete.
Related NHI Mgmt Group resources: NHI lifecycle automation · Joiner-Mover-Leaver (JML) Guide · SCIM and Automated Provisioning Guide · Access Control Policy Template
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Manual leaver handling leaves accounts and adjacent access active after role or employment change. |
| NHI-05 — Overprivileged NHI | Lingering access after lifecycle events creates excessive entitlement exposure across downstream systems. | |
| Recommendation — Track offboarding completion against NHI-01 and close any manual deprovisioning path that leaves access behind. Review lifecycle-linked entitlements for excess access and remove rights that survive the business event. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about controlling and revoking permissions across lifecycle events. |
| Recommendation — Enforce permissions change control so access removal is verified at the downstream system, not only in the HR trigger. | ||
| CIS Controls v8 | CIS-5 — Account Management | Manual provisioning and deprovisioning failures are account management failures with operational and security impact. |
| Recommendation — Centralise account lifecycle tracking and validate that every joiner, mover and leaver action reaches the target system. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | The article centres on creating, changing and terminating accounts across mixed systems. |
| Recommendation — Use AC-2 to govern account creation, modification and termination across all downstream applications. | ||
Key terms
- Joiner Mover Leaver: Joiner Mover Leaver is the identity lifecycle process for creating, changing, and removing access as people enter, change roles, or leave an organization. It governs provisioning, modification, and deprovisioning across systems, ensuring access matches current job needs and reducing orphaned accounts, privilege creep, and residual access risk.
- Provisioning: Provisioning is the process of creating, updating, and removing access for users, devices, applications, and other identities. In IAM and NHI governance, it assigns the right accounts, permissions, secrets, and lifecycle controls so access matches business need, policy, and risk from onboarding through offboarding.
- Deprovisioning: Deprovisioning is the removal of access when a user changes roles or leaves an organisation. For security teams, it is the point where stale accounts, tokens, and permissions should disappear. Weak deprovisioning leaves residual access that can outlive the business need that created it.
- Single Sign On: Single Sign On is a login method that lets a user access multiple applications with one authenticated session. Technically, an identity provider issues a trusted authentication assertion or token after the user signs in, and connected services accept that proof instead of requiring separate passwords for each application.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 5, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org