Topic starter
06/11/2026 6:38 pm
TL;DR: Automated user provisioning handles joiner-mover-leaver events well, according to Serval, but audits still expose orphaned contractor access, informal approvals in Slack, and missing evidence that ties requests to revocation. The governance gap is not provisioning speed, but the absence of a complete, auditable access lifecycle.
Editorial analysis by NHI Mgmt Group, based on content published by Serval: “The hidden gaps in user provisioning automation”.
Key questions
Q: How should security teams govern access requests when request software also provisions access?
A: They should treat the request workflow as part of the IAM control plane.
Q: Why do informal approvals create risk in identity governance?
A: Informal approvals create risk because they leave no durable evidence of who approved access, under what authority, or whether segregation-of-duties checks were applied.
Q: How do you know if contractor access is being offboarded properly?
A: Contractor access is being offboarded properly when every account, API key, token, certificate, and shared secret tied to the contractor automatically triggers revocation or rotation at contract end.
Practitioner guidance
- Standardise the access request path Route mid-employment and contractor access through a controlled intake process with justification, approver identity, and expiry captured before provisioning begins.
- Bind approvals to revocation conditions Require every privileged or temporary grant to carry a time limit or end condition so deprovisioning is triggered automatically when the business need ends.
- Close the contractor offboarding loop Tie engagement end dates to deprovisioning so contractor accounts and elevated entitlements are removed even when the request originated outside the IdP.
Bottom line: Provisioning automation solves the mechanical part of identity lifecycle management, but it does not by itself govern access requests, approvals, or revocation evidence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Provisioning automation is not the same thing as governance. Identity platforms can create, update, and remove accounts at speed, but they do not inherently prove why access was approved, who approved it, or whether the entitlement should have been time bound. The gap appears when organisations confuse lifecycle execution with lifecycle control. Practitioners should separate the automation layer from the evidence layer.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: What are the best practices for implementing just-in-time privileged access?
A: Just-in-time privileged access grants elevated permissions only when a task needs them, then removes them after use. Set short approval and expiry windows, require strong authentication, log elevation requests, and scope access to specific systems or actions. Review standing admin accounts first, because JIT fails when permanent privileges remain outside the process.
👉 Read our full editorial: Provisioning automation leaves the governance gap open