TL;DR: User lifecycle management links onboarding, role changes, and offboarding to access control, but Zluri’s article shows how manual processes still create security gaps across the employee journey. The real issue is not workflow convenience, but whether identity governance can keep pace with access changes before risk accumulates.
At a glance
What this is: This is an analysis of user lifecycle management and its claim that onboarding, mid-lifecycle changes and offboarding still create access-control gaps when handled manually.
Why it matters: It matters because IAM teams need consistent joiner-mover-leaver controls for human identities, or access drift and delayed revocation can leave sensitive systems exposed.
Context
User lifecycle management is the discipline of creating, changing and removing user access as people move through an organisation. The article focuses on onboarding, role changes and offboarding, and argues that gaps appear when those transitions are handled manually or too slowly.
For IAM and IGA teams, the core issue is not whether access should be granted or removed, but whether the organisation can keep entitlement changes aligned to employment changes. That makes lifecycle control a governance problem as much as an operational one.
Key questions
A: Teams should design user lifecycle management as a single joiner-mover-leaver process, not three disconnected tasks. That means defining entitlement templates for onboarding, automatic access recalculation during role changes and complete revocation plus ownership transfer at offboarding. The goal is to keep access aligned to the user’s current status at every stage.
Q: When does manual lifecycle management become a security risk?
A: Manual lifecycle management becomes a risk as soon as entitlement changes depend on tickets, email, or human memory. At that point, access can lag behind role changes, former users can retain permissions, and temporary access can outlast the business need. The practical signal is persistent mismatch between current role and active entitlement.
Q: What breaks when offboarding does not fully remove directory access?
A: The directory stops reflecting current business reality. Access review, privileged access management, and incident response all become less reliable because the system still contains identities that appear authorised but no longer have a valid owner or purpose.
Q: What is the difference between onboarding access and access changes during a role transition?
A: Onboarding access is about provisioning the right baseline entitlements for a new user, while a role transition requires removing access that no longer fits and adding only what the new role needs. Treating them as the same step is a common cause of privilege creep and inconsistent access profiles.
Technical breakdown
Why onboarding creates early access risk
Onboarding is the first point where identity governance can fail because new users need access quickly, but access requests often outpace review. If roles, permissions and application assignments are handled manually, the organisation increases the chance of overprovisioning, inconsistent entitlements and delayed secure access. The problem is not onboarding itself but the lack of a controlled path from hire to authorised access. Automated workflows reduce latency, but the real technical requirement is deterministic assignment of only the access tied to the user’s role and function.
Practical implication: define onboarding rules around role-based entitlement sets rather than one-off access requests.
Mid-lifecycle changes need entitlement recalculation
Role changes, promotions and location changes are where lifecycle management becomes an entitlement recalculation problem. A user may remain active, but their access profile should change when their duties change. If permissions are not re-evaluated at the point of transition, old access persists alongside the new role, creating privilege creep and unnecessary exposure across SaaS and directory-connected systems. This is a classic identity governance failure because the organisation treats access as static while the business treats jobs as dynamic.
Practical implication: trigger access updates automatically when a user’s role or department changes.
Offboarding must revoke access, not just deactivate the account
Offboarding is more than account closure because SaaS access, permissions and ownership can outlive the user if revocation is incomplete. A complete offboarding flow has to disable credentials, remove application access, transfer ownership where needed and preserve only the data retention the business actually requires. If the workflow stops at account deletion, the organisation can still retain exposed entitlements, orphaned access paths or shared application ownership that creates residual risk after departure.
Practical implication: make offboarding a full access and ownership removal process, not a single account-status change.
Threat narrative
Attacker objective: The objective is to leave active or former users with more access than their current role or employment status justifies, increasing the chance of misuse or exposure.
- Entry occurs when a user is onboarded and granted application access through manual or loosely governed provisioning.
- Escalation occurs when role changes or promotions leave old permissions in place while new access is added on top.
- Impact occurs when departing users retain access, ownership or sensitive data paths after offboarding is incomplete.
Breaches seen in the wild
- Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.
- Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
User lifecycle management fails when identity is treated as a point-in-time event rather than a changing state. Onboarding, moving and offboarding are not separate tasks, they are one governance continuum. When organisations handle them manually, access decisions lag behind employment reality and risk accumulates across the full user journey. The practical conclusion is that lifecycle governance has to be continuous, not episodic.
The real control gap is entitlement drift across business transitions. Mid-lifecycle changes are where access should be re-evaluated, yet many programmes only focus on joiner and leaver events. That leaves users with old permissions that no longer match their duties, which is a governance failure rather than a tooling issue. Practitioners should treat role change as a mandatory access recalibration point.
Offboarding is only complete when access, ownership and data paths are all removed. Deactivation alone does not close the exposure window if SaaS licences, application ownership or shared permissions remain active. This is why lifecycle programmes need revocation, transfer and retention logic in the same workflow. The practitioner takeaway is simple: leaving access behind after departure is a governance defect, not an edge case.
Lifecycle control is now a core identity security control, not an HR convenience. The article’s core message is that employment changes create predictable security risk unless IAM, IGA and operations are tied together. That aligns with OWASP-NHI-style thinking about lifecycle discipline, even though the subject here is human identity. The field should treat joiner-mover-leaver governance as a security boundary, not just a service desk process.
What this signals
Lifecycle governance becomes a security control when organisations connect HR status, entitlement management and deprovisioning in one flow. The weakest point is often not initial access but the period when a person’s job changes and the access model does not.
Entitlement drift: when roles change faster than access reviews, users carry permissions that no longer fit their duties. Programmes that only certify existing access without re-evaluating the transition event will keep missing the real control failure.
For identity teams, the practical test is whether joiner-mover-leaver processes are automated enough to remove stale access before it becomes a standing exception. If the answer is no, the lifecycle process is acting as a ticket queue rather than an access control boundary.
For practitioners
- Standardise joiner-mover-leaver workflows Define role-based onboarding, transition and offboarding workflows so access changes follow employment status changes consistently across core applications and directories.
- Recalculate entitlements on role change Trigger permission review and access reassignment whenever an employee changes department, role or location so inherited access does not remain in place by default.
- Remove access and ownership at offboarding Build offboarding steps that disable accounts, revoke SaaS access, transfer ownership of active assets and remove unnecessary data paths before the user departs.
- Audit for privilege creep in mid-transitions Review accounts that have changed roles recently and look for excess access that was never removed during a transition, especially in SaaS estates.
Key takeaways
- User lifecycle management is a governance problem because access must change as quickly as employment status changes.
- The main risk is entitlement drift across onboarding, role transitions and offboarding, especially when those steps are manual.
- The control lesson is to tie provisioning, recalculation and revocation into one lifecycle workflow that removes access as well as grants it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | User lifecycle management centers on provisioning, changes and account removal across the user journey. |
| Recommendation — Use AC-2 to govern account creation, modification, review and removal across the full lifecycle. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about keeping access aligned to user status through onboarding and offboarding. |
| Recommendation — Apply PR.AA-05 to align entitlements with current user role and remove stale access promptly. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity Management | Lifecycle control depends on a managed identity process for users across status changes. |
| Recommendation — Implement A.5.16 to keep user identities and their access state synchronised through lifecycle changes. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article describes account provisioning and removal as the central security control. |
| Recommendation — Use CIS-5 to manage account lifecycle events and eliminate stale accounts and access paths. | ||
Key terms
- User Life Cycle Management: User life cycle management is the end-to-end process of creating, updating, reviewing, and removing user identities and access across enterprise systems. It links identity governance to employee onboarding, role changes, and offboarding so access stays aligned with job responsibilities and business need.
- Joiner-Mover-Leaver Lifecycle: The joiner-mover-leaver lifecycle describes the access changes that should happen when a person or account is created, changes role, or exits the organisation. It is the basic operating model for keeping entitlements aligned to current need, and it becomes critical when automation replaces manual ticket handling.
- Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.
- Off-boarding: Off-boarding is the process of removing a departing user’s access, credentials, and related entitlements from the environment. In mature IAM programmes, it also includes reviewing sessions, shared secrets, delegated roles, and linked non-human identities so that exit events do not leave behind hidden access paths.
Deepen your knowledge
Identity lifecycle management, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org