Topic starter
06/07/2026 9:44 am
TL;DR: Joiner automation can reduce day-one risk, ticket volume, and license waste by deriving access from known identity attributes, according to Lumos, while also exposing where copy-access habits, fragmented onboarding, and limited entitlement-level provisioning still break down. The deeper issue is that joiner governance fails when access is still treated as a manual exception path rather than a lifecycle control.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “Why You Need to Get Joiners Right and How To Make It Happen”.
Key questions
Q: What breaks when joiners are still handled with copy-access rules?
A: Copy-access rules break least privilege at the point of issuance.
Q: When should organisations prioritise joiner automation over access review?
A: Organisations should prioritise joiner automation when onboarding is still producing avoidable overprovisioning, ticket queues, or day-one access gaps.
Q: How do you know if onboarding is really least privilege?
A: Onboarding is really least privilege when new starters receive only the access tied to their role and no manual cleanup is needed to remove inherited extras.
Practitioner guidance
- Define joiner policies from stable identity attributes Map department, manager, cost center, and job family to access rules so onboarding starts from policy, not from copied access.
- Validate entitlement-level provisioning Test whether the onboarding workflow can create accounts and assign granular permissions in downstream systems, not only group membership in the IdP.
- Remove copy-access as the default onboarding pattern Require a named business rationale whenever a new starter inherits access from a predecessor or peer, and track those exceptions separately.
Bottom line: Joiner automation matters because the first access decision often becomes the template for the rest of the employee lifecycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 10:00 am
Joiner governance is a least-privilege design problem, not an HR admin task. The article is right to separate predictable onboarding from ad hoc requests because the access model should be decided before the employee starts work. When joiners are handled manually, the organisation turns a lifecycle event into a queue of exceptions. The practitioner conclusion is simple: day-one access should be policy-derived, not copy-pasted.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should security teams do when onboarding spans multiple systems?
A: Security teams should treat multi-system onboarding as a control design problem, not a coordination problem. The workflow needs an authoritative source of identity attributes, a way to push account creation and entitlement changes downstream, and a visible record of where manual steps still interrupt the joiner path.
👉 Read our full editorial: Joiner automation exposes the limits of manual identity governance