Topic starter
10/06/2026 9:45 pm
TL;DR: Most organisations only govern access changes that show up in HRIS, yet the source article argues that event-based work, projects, and temporary collaborations create the larger share of access creep by adding access with no clear end point. That gap leaves JML covering the visible minority while the invisible majority compounds silently, according to Zluri. The governance problem is not access review cadence alone, but the lack of cleanup triggers for access that begins outside employment changes.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “A Tale of Two Access-Sprawl Patterns | Jessica vs Sarah”.
Key questions
Q: What breaks when access governance only follows HRIS events?
A: It misses the larger share of access growth that comes from projects, collaboration, emergency work, and other non-HRIS activity.
Q: Why does event-based access create more governance risk than role-change access?
A: Because it usually has a clear start but no reliable end.
Q: How do teams know whether unauthorized access controls are actually working?
A: Look for fewer standing credentials, lower lateral movement potential, and faster revocation when access is no longer needed.
Practitioner guidance
- Map access sources by lifecycle trigger Separate access into HRIS-triggered, project-triggered, emergency-triggered, and migration-triggered categories so you can see which entitlements your current JML process can and cannot govern.
- Add expiry to temporary access Require every project, emergency, and temporary collaboration grant to carry an end date or review checkpoint at issuance, then automate revocation when that checkpoint passes.
- Build cleanup ownership into project closure Assign a named owner for removing access when a project ends, rather than assuming the employee's line manager will notice that the work has finished.
Bottom line: The article argues that access sprawl is not mainly a promotion problem, because temporary work and cross-functional activity create a larger hidden pool of stale access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 6:14 am
Access sprawl is a lifecycle failure, not a staffing-change problem: The article shows that HRIS-driven JML only governs a minority of entitlement growth because much of it begins in project work, collaboration, and temporary operational needs. That means the control model is misaligned with how access is actually created and retained. The practitioner conclusion is that governance must follow the access source, not just the employee record.
A question worth separating out:
Q: What is the difference between role-based access growth and project-based access growth?
A: Role-based growth is tied to formal employment changes that HRIS can see, while project-based growth comes from temporary work that HRIS usually does not model. The first is visible and reviewable, even if poorly managed. The second is invisible until someone actively tracks end dates, ownership, and entitlement cleanup outside the HR workflow.
👉 Read our full editorial: Access sprawl is bigger than role changes: the invisible 60%
This post was modified 4 days ago by NHI Mgmt Group