Onboarding and offboarding remain the identity lifecycle bottleneck

At a glance

What this is: This is a Lumos article arguing that onboarding and offboarding remain the slowest parts of identity lifecycle management, with manual handoffs and disconnected systems creating both delay and security risk.

Why it matters: It matters because lifecycle speed determines how quickly teams can grant the right access, remove stale access, and prove control across human IAM, NHI governance, and broader identity operations.

By the numbers:

• Research shows that organizations with structured onboarding programs increase new hire retention by up to 82% and improve productivity by over 50%.

Context

Onboarding and offboarding are identity lifecycle controls, not administrative chores. When they rely on tickets, email chains, and siloed systems, access decisions drift away from the actual business event that should trigger them, and least privilege becomes harder to enforce from the start.

For identity programmes, the problem is not only speed. It is the gap between a joiner or leaver event and the point at which access is actually provisioned or revoked, which affects human users today and any future non-human lifecycle process that depends on the same governance model.

Lumos frames the issue around automation, self-service access, and AI-assisted role recommendations, but the underlying governance question is broader: who owns access changes, how quickly do they happen, and what evidence proves they happened cleanly?

Key questions

Q: What breaks when onboarding and offboarding stay manual?

A: Manual lifecycle handling breaks because access changes become ticket-driven, slow, and inconsistent across systems. That creates delayed productivity for new hires, orphaned access for leavers, and weak audit evidence. The core failure is not speed alone, but the loss of a reliable trigger, owner, and completion record for each entitlement change.

Q: Why do delayed offboarding processes create security risk?

A: Delayed offboarding creates security risk because access can remain active after the business relationship ends. Former users may still reach email, files, CRM, or admin tools, which expands the window for data theft or disruption. The issue is not the departure itself, but the period during which stale access still works.

Q: How do security teams know if lifecycle automation is actually working?

A: Measure removal completeness, not just provisioning speed. If leaver events are consistently cleared from roles, licenses, and adjacent app access without manual recovery, the lifecycle process is doing real control work. If audit evidence is reconstructed after the fact, the programme is still too dependent on people.

Q: Who should own onboarding access decisions in a mature IAM programme?

A: Onboarding access decisions should be shared across IAM, application owners, and security, with clear policy ownership and operational execution separated. IAM should govern the rules, application owners should validate access fit, and security should oversee risk-sensitive destinations. That split keeps onboarding from becoming either fully manual or fully unchecked.

Technical breakdown

Why manual onboarding creates access bottlenecks

Manual onboarding usually depends on IT as the routing layer for every request, approval, and entitlement change. That means access becomes a queue-management problem instead of a lifecycle event tied to HR status, role, and application ownership. The technical failure is not just delay. It is that each handoff creates ambiguity about who approved what, when the change occurred, and whether birthright access was provisioned consistently. In that model, provisioning logic is fragmented across HRIS, IdP, ITSM, and app teams, so the process is slow by design and difficult to audit.

Practical implication: move joiner-triggered access changes closer to HR events and reduce ticket-mediated provisioning steps.

How offboarding leaves orphaned access behind

Offboarding breaks when revocation is coordinated manually across disconnected systems. The result is active accounts, stale entitlements, and access that outlives employment status, which turns a lifecycle lapse into an exposure window. In identity terms, the control failure is not merely delayed deprovisioning. It is incomplete deprovisioning, where directory disablement does not guarantee removal from downstream SaaS, cloud, or on-prem applications. That is why orphaned accounts remain such a common source of privilege creep and audit friction.

Practical implication: verify that leaver processing removes access across every connected application, not just at the directory layer.

Why role recommendations matter only if ownership is clear

AI-driven role recommendations can reduce overprovisioning, but only when app ownership, access policy, and approval responsibility are already defined. Without that governance layer, recommendations merely automate guesswork at scale. The technical issue is that access models need stable reference data: role, department, location, application criticality, and approver mapping. If those inputs are incomplete or inconsistent, the output may be fast but still wrong. Governance therefore has to precede automation, not follow it.

Practical implication: fix app ownership and approval mapping before using recommendation engines to accelerate lifecycle decisions.

Threat narrative

Attacker objective: The attacker objective is to exploit stale or excessive access that remains after lifecycle processes fail to revoke or scope entitlements properly.

1. Entry begins when a joiner or leaver event is handled through tickets, emails, or ad hoc manual workflows instead of a governed lifecycle trigger.
2. Credential or account access is then provisioned or left active inconsistently across HRIS, IdP, and downstream applications.
3. Escalation appears as overprovisioned access, orphaned accounts, and delayed revocation that widen the attack surface and complicate audits.
4. Impact is reduced productivity, stronger insider risk exposure, and weaker evidence that least privilege and revocation were enforced.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity lifecycle is now an access control plane, not an HR workflow. When joiner and leaver events are handled through tickets and disconnected approvals, the organisation is no longer governing access at the point of business change. That turns provisioning and revocation into lagging operational tasks instead of live control decisions. Practitioners should treat lifecycle orchestration as a core identity control surface, not an administrative convenience.

Manual offboarding creates a revocation gap that most audit programmes still underestimate. The problem is not simply slow closure. It is that partial disablement can leave downstream application access intact, which means the employee relationship ends before the privilege relationship does. The practical implication is that evidence of directory disablement is not evidence of complete revocation.

Access ownership is the hidden dependency that determines whether automation works. AI-assisted role recommendations, self-service requests, and workflow orchestration only function when application ownership, approver mapping, and entitlement logic are already defined. Without that governance layer, automation can accelerate the wrong decision faster. Practitioners should fix ownership before they scale automation.

Identity lifecycle governance needs to converge across human access and machine access. The same lifecycle logic that governs joiners and leavers for employees will increasingly govern service accounts, tokens, and agent identities as organisations expand automation. The control question is whether the programme can describe who or what owns access at every stage of creation, change, and removal. Teams that solve the human case in isolation will still inherit the next lifecycle bottleneck.

Structured onboarding is a measurable business control, not just a user-experience metric. Lumos cites retention and productivity gains, but the deeper lesson is that faster access is only valuable when it is paired with constrained entitlement scope and provable revocation. The benchmark for maturity is not speed alone. It is whether the organisation can provision quickly without creating a long-lived privilege problem.

From our research library:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Identity lifecycle bottlenecks expose a broader governance pattern: access provisioning and revocation still fail when the system of record for employment changes is disconnected from the system that actually grants access. For IAM and IGA teams, the next step is not more ticketing discipline but tighter event-driven orchestration across HR, IdP, and applications.

Lifecycle controls must now be evaluated by outcome, not process count: the relevant question is whether the organisation can create, adjust, and remove access at the speed of the business event without widening privilege scope. That matters equally for human access today and for machine or agent lifecycle workflows that will inherit the same governance assumptions.

For practitioners

• Map joiner and leaver triggers to identity events Tie HR status changes directly to provisioning and deprovisioning workflows so access changes begin when employment status changes, not when tickets are opened.
• Eliminate directory-only offboarding Confirm that leaver processing removes access from downstream SaaS, cloud, and on-prem applications, not just by disabling the central directory account.
• Document application ownership for every entitlement Assign a responsible owner for each application and entitlement so approvals, reviews, and revocations have a named decision-maker.
• Use role recommendations only after governance data is clean Validate role, department, location, and approver mappings before enabling automated recommendations so the system does not scale bad entitlement logic.
• Prove offboarding through revocation evidence Retain timestamped confirmation that each access path was removed, because audit readiness depends on complete revocation evidence, not just a closed ticket.

Key takeaways

• Onboarding and offboarding remain bottlenecks because manual handoffs still separate business events from access changes, which weakens both productivity and control.
• The article ties structured onboarding to up to 82% higher new hire retention and more than 50% productivity improvement, underscoring that lifecycle speed has operational value.
• Practitioners should focus on event-driven provisioning, downstream revocation, and named ownership so lifecycle automation improves control instead of accelerating inconsistency.

Key terms

• Identity Lifecycle Governance: Identity lifecycle governance is the set of processes that create, change, review, rotate, and revoke access across human and non-human identities. It matters because access risk usually increases when lifecycle events are slow, incomplete, or disconnected from the systems that rely on them.
• Off-boarding: Off-boarding is the process of removing a departing user’s access, credentials, and related entitlements from the environment. In mature IAM programmes, it also includes reviewing sessions, shared secrets, delegated roles, and linked non-human identities so that exit events do not leave behind hidden access paths.
• Birthright Access: The baseline set of entitlements that a user should receive by default because of role, department, or another stable attribute. It is a governance construct, not a blanket permission model. The control challenge is proving that the baseline stays current as jobs, applications, and ownership change.
• Entitlement Ownership: The assignment of accountability for a specific access right, application permission, or entitlement set to a named business owner. It is the control that gives approvals meaning. Without ownership, automation can still issue access, but no one can credibly explain why the access was approved or when it should be revoked.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.