TL;DR: User provisioning sits at the centre of lifecycle management, and Zluri argues that hybrid work, cloud sprawl, and manual account handling make role-based access harder to maintain consistently. The practical lesson is that provisioning quality is now a governance issue, not just an onboarding workflow problem.
At a glance
What this is: Zluri’s guide reframes user provisioning as a lifecycle governance problem, arguing that manual handling, hybrid work, and cloud sprawl make access control harder to keep consistent across joiners, movers, and leavers.
Why it matters: IAM and IGA teams need to treat provisioning as an ongoing governance control because access quality now depends on continuous change management, not just initial account creation.
Context
User provisioning is the set of processes used to create, modify, and remove access for people as their role changes. The article’s core point is that this is no longer an onboarding-only activity, because hybrid work and cloud services make access changes more frequent and harder to govern.
The governance gap is lifecycle drift: access that starts out correct can become inappropriate when employees move roles, contractors expire, or manual workflows fall behind. For IAM and IGA teams, the issue is not just speed but control over who keeps access, who loses it, and who reviews it over time.
Key questions
Q: What breaks when onboarding and access provisioning are not linked?
A: When onboarding and access provisioning are not linked, organisations can activate clients or staff with incomplete validation and excessive access. The result is entitlement sprawl from day one, weaker audit evidence, and a higher chance that servicing rights outlive the conditions that justified them.
Q: Why do manual provisioning processes increase access risk in dynamic environments?
A: Manual provisioning cannot keep pace with constant role changes, new applications, and offboarding requirements. The result is inconsistent permissions, lingering access, and more opportunities for misconfiguration. In high-change environments, the control problem is not just speed. It is whether access state remains synchronized with the organisation’s actual identity lifecycle.
Q: How do you know if provisioning is actually working?
A: Provisioning is working when account creation, attribute changes, and removals in connected applications match the authoritative identity source without backlog or manual exceptions. The clearest signal is whether offboarding removes access cleanly and role changes propagate before users need to self-correct.
Q: Should SMBs prioritise automated provisioning before access reviews?
A: Usually yes, if the business is still handling joiners and leavers manually. Automating the lifecycle reduces the risk of stale access at the source, while reviews confirm that the remaining access model is still accurate and justified. The two controls work best in sequence, not isolation.
Technical breakdown
Why lifecycle-managed provisioning is harder in cloud-first environments
Provisioning used to be easier to centralise when most access sat inside a smaller number of on-premises systems. In cloud-first environments, third-party services, distributed application ownership, and multiple access request paths make the lifecycle of a user account harder to keep aligned with role changes. The result is not only slower onboarding, but also inconsistent modification and deprovisioning. That inconsistency creates gaps between what the business thinks a user can access and what the user can actually reach across the application estate.
Practical implication: map provisioning ownership across HR, IT, and app owners before automation so lifecycle decisions are not fragmented.
How manual provisioning turns access governance into a control problem
Manual provisioning is not just inefficient. It creates a governance defect because the quality of access depends on people repeating the same steps correctly every time, under time pressure, across many systems. As the number of users and applications rises, human error becomes a standing source of entitlement drift. Lifecycle governance therefore has to cover changes, revocations, and periodic access review, not only the initial account setup. Once that happens, provisioning behaves like an identity control plane rather than a ticketing task.
Practical implication: reduce hand-built access changes and require workflow-backed approvals for creates, updates, and deletions.
Why automated provisioning must include review and deprovisioning
Automation solves only part of the provisioning problem if it stops at joiner events. A lifecycle model has to carry the user through role changes, temporary access, and eventual removal. The article emphasises predefined workflows, access control, and ongoing review because entitlement correctness decays over time if no one checks whether access still fits the role. That is why provisioning and recertification belong to the same governance conversation: one grants access, the other proves it still belongs there.
Practical implication: tie automated provisioning to access reviews and leaver offboarding so entitlement state stays current.
Threat narrative
Attacker objective: The objective is to exploit weak lifecycle governance so access remains broader or longer-lived than the business intended.
- Entry occurs when a new employee, contractor, or partner is granted access as part of provisioning, often through role-based onboarding workflows.
- Escalation happens when role changes, promotions, or temporary assignments are not reflected promptly, leaving excess privileges in place.
- Impact follows when stale access persists across systems, creating security, compliance, and productivity risk through inappropriate access.
- Operational failure is amplified when manual steps or third-party-managed services prevent teams from seeing the full entitlement picture.
Breaches seen in the wild
- Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.
- Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Provisioning has become a lifecycle governance issue, not a joiner task. The article is right to move the conversation away from onboarding alone, because access quality decays whenever role changes, temporary access, or offboarding sit outside the same control plane. That means the real control question is whether entitlement state remains accurate across the full user lifecycle. Practitioners should treat provisioning as a governed lifecycle, not a one-time fulfillment process.
Manual provisioning creates entitlement drift by design. When each access change depends on human execution across multiple systems, inconsistency becomes structural rather than exceptional. The consequence is a widening gap between approved access and actual access, especially in cloud-heavy environments with third-party-managed services. For IGA teams, the lesson is to measure lifecycle correctness, not just ticket completion.
Continuous review is the missing half of provisioning. The article correctly notes that access should be reviewed to ensure it remains appropriate, because initial approval does not prove continued need. That review requirement is what links provisioning to access certification, offboarding, and least-privilege maintenance. Practitioners should judge provisioning by how well it sustains reviewable, revocable entitlements over time.
Lifecycle governance is now the operating model for user access. The named concept here is provisioning drift: access that was correct at creation but becomes misaligned as roles, contractors, or systems change. This is a governance problem because the system of record for entitlement state no longer matches operational reality. Teams should design their IAM programme around that drift, not around the initial account creation event.
From our research library:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
- Read next: NHI Lifecycle Management Guide
What this signals
Provisioning drift: the gap between approved access and actual access grows when joiner, mover, and leaver events are handled by different workflows or owners. That gap is what turns a routine IAM process into a governance risk, because entitlement accuracy depends on continuous lifecycle control rather than one-time approval.
When access reviews, role changes, and deprovisioning are not tied to the same operating model, automation can accelerate inconsistency as easily as it reduces toil. IAM teams should watch for that pattern in cloud services, contractor access, and any environment where multiple app owners share entitlement responsibility.
For practitioners
- Build a lifecycle-owned provisioning workflow Assign clear ownership for create, change, review, and delete actions so account state follows the full user lifecycle, not just onboarding.
- Automate role-based access changes Use predefined workflows to grant, modify, and remove access based on role and permission level, with fewer manual touchpoints.
- Add periodic access review checkpoints Require recurring checks on whether assigned access still matches job role, contractor status, or project need.
- Separate temporary access from permanent access Treat contractor and short-term access as time-bounded entitlements with explicit expiry and removal paths.
- Track deprovisioning as a control outcome Measure how reliably accounts and associated access privileges are removed when a user leaves or no longer needs access.
Key takeaways
- User provisioning is only reliable when it is governed across the full lifecycle, not treated as a one-time onboarding activity.
- Manual handling and fragmented ownership create entitlement drift, especially when roles, contractors, and cloud services change quickly.
- Automated workflows help most when they cover creation, modification, review, and removal as one control loop.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article ties provisioning quality to removal and lifecycle control when users leave or change roles. |
| NHI-05 — Overprivileged NHI | The article’s access drift problem maps to entitlement growth beyond what the role needs. | |
| Recommendation — Review offboarding workflows for missed account removal and close gaps between HR exit and access revocation. Audit role-based entitlements for privilege creep and remove access that exceeds job need. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The piece is fundamentally about governing who gets which access and when it is changed or removed. |
| Recommendation — Apply PR.AA-05 to ensure entitlements are approved, current, and reviewed through the user lifecycle. | ||
| CIS Controls v8 | CIS-5 — Account Management | Provisioning, modification, and deletion are core account management functions in this article. |
| Recommendation — Use CIS-5 to standardise account creation, changes, and removal across systems. | ||
Key terms
- User Provisioning: User provisioning is the process of creating, changing, and removing access rights across systems. In practice, it includes account creation, role assignment, permission updates, and deprovisioning. The security value comes from keeping access aligned to current business need throughout the identity lifecycle.
- Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.
- Deprovisioning: Deprovisioning is the removal of access when a user changes roles or leaves an organisation. For security teams, it is the point where stale accounts, tokens, and permissions should disappear. Weak deprovisioning leaves residual access that can outlive the business need that created it.
- Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org