Mover events are the missing control in identity lifecycle governance

At a glance

What this is: This is an analysis of why mover events remain the weakest link in identity lifecycle governance, with Zluri arguing that most organisations still rely on manual follow-up for access changes between joiner and leaver states.

Why it matters: It matters because internal moves are where privilege creep accumulates, and IAM, IGA and PAM programmes that cannot see or act on these transitions will keep over-provisioning access across NHI, autonomous and human workflows.

Context

Mover events are mid-lifecycle identity changes such as promotions, department transfers, location changes, project assignments and leave coverage. In identity governance terms, they sit between joiner and leaver processes, but unlike those events they often lack a clear trigger, an obvious target state and a dependable automation path.

That gap matters because access typically expands during a move, but the corresponding removals do not happen with the same discipline. The result is gradual privilege creep across human IAM programmes, and the same lifecycle logic becomes relevant whenever access is governed through non-human accounts, delegated credentials or autonomous systems with changing responsibilities.

Key questions

Q: Why do mover events create more risk than joiner or leaver events?

A: Mover events are harder because the identity already exists, so the problem is not creation or deletion but reclassification. Teams must remove obsolete access while adding new access quickly enough to avoid productivity loss, overexposure, and approval backlogs. That combination makes movers the lifecycle moment most likely to produce drift.

Q: What happens when organisations do not automate mover access changes?

A: Without automation, mover access depends on people remembering to act after promotions, transfers, leave changes or project assignments. That usually means manual tickets, Slack messages and delayed cleanup, which leaves stale access active far longer than intended. The operational consequence is privilege creep that becomes visible only during audits or incidents.

Q: How should teams handle temporary access for projects and coverage?

A: Treat temporary access as an expiring entitlement, not as a special favour that will be cleaned up later. Set a duration at approval time, route approval through the right owner and ensure the grant is automatically removed when the task, leave or coverage period ends. If expiry is not part of the grant, the access will linger.

Q: How do teams know whether mover governance is working?

A: They should look for whether role changes automatically produce access reviews, approval-path updates, and entitlement comparisons against the new role profile. If mover events do not consistently change the access state, the lifecycle process is not enforcing governance, only recording HR change.

Technical breakdown

Why mover events break the joiner-leaver model

Joiner and leaver flows are easy to model because the destination is binary: grant access needed for a role, or remove everything on exit. Mover events are different because the control objective is delta management, not simple provisioning or deprovisioning. That requires current-state visibility, role-to-access mapping, and logic for what must be removed, retained or changed in scope. Without that baseline, identity systems can only add access and hope humans clean up the rest later.

Practical implication: teams need authoritative current-access inventory before mover automation can make safe decisions.

Scheduled mover changes versus event-based access changes

Some mover events are recorded by HR systems, such as promotions, department changes or leave status. Others exist only in the workflow that created them, such as project access, emergency access or temporary coverage. Scheduled changes can be triggered from HRMS data if the automation exists, while event-based grants require access-request governance with explicit duration and expiry. The technical distinction is whether a trustworthy system-of-record can signal the change at all.

Practical implication: classify mover events by trigger source before deciding whether HR-driven automation or request-based expiry should govern them.

Why access duration becomes a control point

Mover events often create legitimate access that should not persist indefinitely, especially for project work, backup coverage and temporary elevated access. If duration is not defined at grant time, the removal step is deferred to memory, audit, or review, which is exactly where stale access persists. The control failure is not just missing revocation. It is the absence of an expiry condition attached to the original grant, which makes the access lifecycle incomplete from the outset.

Practical implication: bind time-bounded access to the grant itself instead of relying on later cleanup.

Threat narrative

Attacker objective: The end state is an inflated access footprint that no longer matches the person’s current job and can be abused or inherited into sensitive systems.

1. Entry occurs through an internal role change, temporary assignment or coverage request that expands access without a matching removal trigger.
2. Credential or entitlement accumulation follows when the new access is added but prior access is left in place across applications, permissions and shared grants.
3. Impact appears later as privilege creep, with employees carrying access from multiple former roles into audits, investigations or misuse scenarios.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Mover events expose the limits of lifecycle governance built around binary identity states. Joiners and leavers map cleanly to grant-all or revoke-all logic, but movers require delta-based governance that many programmes still cannot express. That is why organisations keep adding access faster than they remove it. The implication is that identity governance has to move from event labels to access-state transitions.

Privilege creep in mover flows is usually a visibility failure before it is a policy failure. The article is right to separate what HR knows from what the access layer actually holds. If the system cannot see all current entitlements, it cannot safely decide what to retain or remove. Practitioners should treat incomplete current-state inventory as a structural control gap, not a workflow inconvenience.

Access Duration is the named control concept this problem has been missing. Time-bound grants are not just a convenience for temporary work. They force the removal decision to be made when access is created, which is where mover governance usually fails. That shifts lifecycle discipline from review-time cleanup to issuance-time intent, which is the only durable way to prevent silent accumulation.

Movers are where IAM, IGA and PAM meet the same governance problem from different angles. Human role changes, service-account ownership changes and autonomous workflow changes all create entitlement drift if access is not recalculated at the moment of change. A mature programme should stop treating movers as an edge case and start treating them as the point where lifecycle governance is actually tested.

One new concept stands out: mover delta governance. The practical question is no longer whether an employee moved, but what access delta should be applied, preserved or removed across every system the person can reach. That concept is more operationally useful than another reminder about recertification because it pushes governance toward state reconciliation, not periodic memory.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: NHI Lifecycle Management Guide

What this signals

Mover delta governance: The real control problem is not whether an employee changed roles, but whether the access delta is recalculated across every system that person can reach. Programmes that still rely on reviewer memory will keep normalising residual access as an acceptable side effect of internal mobility.

Identity lifecycle teams should treat mover handling as a state-reconciliation problem, not a ticket-routing problem. That means current access inventory, event classification and expiry logic become first-class controls rather than administrative backstops.

According to the 2026 Infrastructure Identity Survey, 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems. The same shift applies here: lifecycle governance is moving from static roles to dynamic state changes, and mover events are where that transition becomes visible first.

For practitioners

• Inventory current access state Build a complete view of what each person actually holds across apps, permissions, shared credentials and delegated grants before automating mover workflows.
• Separate scheduled and event-based movers Route HRMS-recorded moves such as promotions, transfers and leave status through automated playbooks, and govern project, temporary and emergency access through request flows with expiry.
• Define access deltas for common role changes Map what should carry forward, what should be removed and what new access is needed for the most common internal moves in your organisation.
• Bind time limits to temporary grants Require duration at approval time for coverage, project and elevated access so removal is triggered by the grant itself rather than by a later review.
• Reconcile mover governance across identity types Extend mover handling to service accounts, delegated automation and other non-human identities when ownership or purpose changes, not just employee records.

Key takeaways

• Mover events are the part of identity lifecycle governance where access usually expands faster than it is removed, creating quiet privilege creep.
• The core failure is lack of current-state visibility and trigger logic, not the absence of policy language or approval steps.
• Time-bound grants and state reconciliation are the controls that most directly limit mover-driven access accumulation.

Key terms

• Mover event: A mover event is a change in role, team, location, manager, or job function that can alter what access a person should have. In governance programmes, mover events are often the clearest signal that access must be re-evaluated immediately rather than waiting for a periodic review.
• Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
• Access Delta: The difference in permissions, roles, groups, or application entitlements between two identities. In governance terms, the delta is useful because it shows what needs justification, not just what exists. In identity programmes, a large unexplained delta is often the earliest sign of privilege creep or mis-scoped access.
• Time-Based Grant: A temporary authority that allows repeated calls for a defined requester, server, and tool tuple until expiry. It reduces repeated review for stable actions, but it also widens the review gap if later arguments materially change the risk of execution.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.