Notifications
Clear all
Topic starter
11/06/2026 11:25 pm
TL;DR: Manual onboarding and request workflows leave employees waiting for access, burden IT teams, and create avoidable control gaps, according to Zluri’s lifecycle management post. Automated provisioning and request routing shift the bottleneck from tickets to governance, but they also expose how fragile role-based access decisions become when lifecycle steps stay manual.
NHIMG editorial — based on content published by Zluri: Lifecycle Management How to Ensure Employees Get the Right Tools at the Right Time
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should security teams automate employee onboarding without creating access sprawl?
A: Start with a minimal role-based entitlement model, then automate only the apps that are clearly required for that role.
Q: Why do lifecycle workflows often create access governance problems instead of solving them?
A: They fail when organisations automate incomplete identity data or broad role definitions.
Q: What breaks when offboarding does not remove access across all SaaS systems?
A: Residual access survives in the systems that do not share the same source of truth, which leaves project tools, collaboration apps, and business platforms open after the employee has left.
Practitioner guidance
- Standardise joiner playbooks by role Define reusable onboarding workflows for each core role and business unit, then map each workflow to a minimal entitlement set for the apps that role actually needs.
- Tighten approver rules for app requests Limit access request approvals to named app owners or delegated approvers, and separate high-risk applications from routine self-service catalog items.
- Audit deprovisioning against system entitlements Verify that offboarding removes access in HR, SaaS, project tools, and communication platforms, not just in the identity directory.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step onboarding playbooks for creating reusable workflow templates across roles and departments
- App Catalog and Access Request configuration detail for routing approvals and pre-approving business apps
- Examples of action settings and scheduled task execution for onboarding day automation
- Procurement workflow detail for app requests that fall outside the existing catalog
👉 Read Zluri's article on lifecycle management and employee access automation →
Employee lifecycle automation: what IAM teams need to fix?
Explore further
12/06/2026 8:04 am
Employee lifecycle automation is a governance problem before it is an efficiency problem. The article frames automation as a way to reduce manual work, but the deeper issue is whether access decisions remain explainable, reviewable, and reversible as the organisation scales. Lifecycle governance fails when process speed is treated as the main metric and entitlement correctness is left implicit. Practitioners should treat workflow design as access governance design.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who should own lifecycle decisions when access is delegated across IT, HR, and app owners?
A: Ownership should sit with the process that can prove entitlement validity end to end, usually a combination of identity governance and app ownership with clear HR triggers. If ownership is split without decision rules, each team assumes another group is handling removal, approval, or review.
👉 Read our full editorial: Employee lifecycle automation exposes where manual access control fails
