Notifications
Clear all
Topic starter
06/07/2026 9:44 am
TL;DR: Joiner automation can reduce day-one risk, ticket volume, and license waste by deriving access from known identity attributes, according to Lumos, while also exposing where copy-access habits, fragmented onboarding, and limited entitlement-level provisioning still break down. The deeper issue is that joiner governance fails when access is still treated as a manual exception path rather than a lifecycle control.
NHIMG editorial — based on content published by Lumos: Why You Need to Get Joiners Right and How To Make It Happen
Questions worth separating out
Q: How should organisations automate joiner access without creating privilege sprawl?
A: Use stable identity attributes to drive role-based or policy-based access, then validate the entitlement set before provisioning.
Q: Why do joiner workflows often fail in mature IAM programmes?
A: They fail when organisations know how to start onboarding but not how to assign the right entitlements across many downstream systems.
Q: What do security teams get wrong about day-one access?
A: They often treat speed as the primary success measure and accept excessive access to avoid delay.
Practitioner guidance
- Map joiner access to stable identity attributes Define which attributes actually drive day-one access, then test whether department, manager, cost centre, and location produce consistent entitlement decisions across your core applications.
- Eliminate peer-copy provisioning as a default pattern Require policy-based role assignment for new hires so onboarding does not inherit access from a predecessor whose permissions may no longer fit the job.
- Measure entitlement-level provisioning coverage Audit how far onboarding automation reaches beyond the directory and whether it can create accounts, assign permissions, and complete downstream writes in the systems most used by new employees.
What's in the full article
Lumos's full blog covers the operational detail this post intentionally leaves for the source:
- How Lumos describes AI-powered policy creation for joiner automation and the role of its identity AI agent in policy generation.
- What its connector approach claims to cover across IdPs, HRIS platforms, SaaS tools, and on-prem systems.
- How the workflow visibility model is presented for automated and manual onboarding tasks.
- The vendor's own examples of day-one productivity and reduced ticket volume in deployed environments.
👉 Read Lumos's blog on why joiner automation matters for identity governance →
Joiner automation and day-one access: are your controls keeping up?
Explore further
06/07/2026 10:00 am
Joiner automation is an IAM control problem, not an HR convenience feature. The core issue is whether a new employee starts with the smallest access set that still supports day-one productivity. When onboarding is treated as a manual exception path, access sprawl becomes the default operating model and the rest of the lifecycle inherits that excess. Practitioners should treat joiner design as a policy and governance decision, not a workflow optimisation exercise.
A few things that frame the scale:
- The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to Oasis Security & ESG.
A question worth separating out:
Q: How can IAM teams tell whether joiner automation is actually working?
A: Look for reduced manual exceptions, fewer provisioning tickets, and a lower rate of unused permissions assigned at onboarding. If workflows are automated but access still needs frequent cleanup, the programme is only partially mature. Real success is when access is correct at the point of hire and stays aligned through reviews.
👉 Read our full editorial: Joiner automation exposes the limits of manual identity governance
