Topic starter
24/06/2026 11:41 pm
TL;DR: BJ’s Wholesale Club says automation around onboarding and offboarding reduced manual access ticket volume by 80%, improving employee experience and lowering identity risk according to SailPoint. The real lesson is that workflow automation only helps when it is tied to lifecycle governance, not treated as a substitute for access control discipline.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “BJ’s Wholesale Club Delivers Savings and Automation with Identity Security”.
Key questions
Q: How should teams govern access when workflows automate onboarding and offboarding?
A: Treat the workflow as part of the identity control stack.
Q: Why does workflow automation reduce risk only when it is tied to lifecycle controls?
A: Because the risk sits in delayed, inconsistent, or forgotten access changes.
Q: What are the signs that automated identity workflows are working properly?
A: Look for consistent approval paths, fewer exception-driven tickets, and complete removal of access when someone leaves or changes role.
Practitioner guidance
- Define lifecycle rules before expanding automation Specify which onboarding, mover, and offboarding actions are fully automated, which require approval, and which must remain manual for review.
- Map every automated access path to a governance owner Assign accountable owners for the policy logic behind each automated identity workflow so exceptions, approvals, and removals are traceable.
- Measure access operations by control quality Track revocation completeness, approval consistency, and exception rates alongside ticket volume to see whether automation is improving governance.
Bottom line: BJ’s Wholesale Club used automation to reduce manual access tickets, but the governance value comes from how the workflow controls identity change, not from speed alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:38 am
Lifecycle automation is only valuable when it is bounded by identity governance. The article shows a familiar pattern: organisations reduce manual effort first, then discover that the real value depends on whether the workflow enforces policy rather than just moving tickets faster. In IAM terms, automation is a delivery mechanism, not the control itself. The practitioner conclusion is to treat automation as a means of executing lifecycle policy at scale.
A question worth separating out:
Q: What should IAM teams do first when moving from manual tickets to automation?
A: Start by documenting the lifecycle events that should trigger access changes, then assign ownership for each rule. That makes it possible to automate safely without guessing which requests are low risk and which need human review. Early clarity prevents workflow sprawl later.
👉 Read our full editorial: Automation cut BJ's access tickets by 80%, but governance matters