Topic starter
05/07/2026 10:44 pm
TL;DR: Mover events are still the least automated part of identity lifecycle management, with most organisations relying on Slack messages, manual tickets, or memory for promotions, transfers, leave coverage, and project-based access changes according to Zluri. The governance gap is not the absence of policy, but the lack of visibility and triggers needed to remove access as deliberately as it is granted.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Movers Are the Orphan Child of Identity Management”.
Key questions
Q: Why do mover events create more risk than joiner or leaver events?
A: Mover events are harder because the identity already exists, so the problem is not creation or deletion but reclassification.
Q: What happens when organisations do not automate mover access changes?
A: Without automation, mover access depends on people remembering to act after promotions, transfers, leave changes or project assignments.
Q: How should teams handle temporary access for projects and coverage?
A: Treat temporary access as an expiring entitlement, not as a special favour that will be cleaned up later.
Practitioner guidance
- Inventory current access state Build a complete view of what each person actually holds across apps, permissions, shared credentials and delegated grants before automating mover workflows.
- Separate scheduled and event-based movers Route HRMS-recorded moves such as promotions, transfers and leave status through automated playbooks, and govern project, temporary and emergency access through request flows with expiry.
- Define access deltas for common role changes Map what should carry forward, what should be removed and what new access is needed for the most common internal moves in your organisation.
Bottom line: Mover events are the part of identity lifecycle governance where access usually expands faster than it is removed, creating quiet privilege creep.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 10:47 pm
Mover events expose the limits of lifecycle governance built around binary identity states. Joiners and leavers map cleanly to grant-all or revoke-all logic, but movers require delta-based governance that many programmes still cannot express. That is why organisations keep adding access faster than they remove it. The implication is that identity governance has to move from event labels to access-state transitions.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do teams know whether mover governance is working?
A: They should look for whether role changes automatically produce access reviews, approval-path updates, and entitlement comparisons against the new role profile. If mover events do not consistently change the access state, the lifecycle process is not enforcing governance, only recording HR change.
👉 Read our full editorial: Mover events are the missing control in identity lifecycle governance