Topic starter
22/07/2026 4:35 pm
TL;DR: Joiner-mover-leaver governance only works when lifecycle events revoke and adjust access across both digital systems and physical credentials, according to AlertEnterprise. The control gap is not the workflow itself but the perimeter it fails to cover, because badge access often remains on a parallel manual track after HR changes.
Editorial analysis by NHI Mgmt Group, based on content published by AlertEnterprise: “The Joiner-Mover-Leaver Process: How Identity Lifecycle Management Extends to Physical Access”.
Key questions
Q: What breaks when JML stops at the digital perimeter?
A: A joiner-mover-leaver process that only covers accounts leaves physical credentials outside the lifecycle record.
Q: Why does physical access create continued risk after a transfer or termination?
A: Because the access state can diverge from the HR state.
Q: How do organisations know if JML is working across badges and applications?
A: They should measure revocation latency in both domains and compare the badge to the account.
Practitioner guidance
- Make HR the single lifecycle trigger Route hire, transfer, and termination events from one authoritative source so digital and physical access respond to the same record.
- Extend birthright access into physical credentials Define role-based facility access before automation so joiner events can issue the right badge or mobile credential on day one.
- Design mover workflows to subtract first Remove prior building, floor, or unit access in the same transfer action that grants the new role’s access.
Bottom line: Joiner-mover-leaver governance does not reach full effectiveness until it covers badges, facilities, and other physical credentials as part of the same lifecycle model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/07/2026 4:40 pm
JML is incomplete until it governs physical access. Identity lifecycle is often treated as a directory and application problem, but the article shows that the enterprise still runs a second access system at the door. That creates a split governance model where HR can update digital rights while physical credentials remain on a manual track. The practitioner implication is straightforward: lifecycle governance is only complete when one event governs both the account and the badge.
A question worth separating out:
Q: What is the difference between PIAM and PACS in identity governance?
A: PACS is the door-control layer that decides whether a badge opens a door. PIAM is the governance layer that decides whether the person should still hold that badge at all, based on lifecycle events and access policy. Identity teams need PIAM if they want physical access to follow JML rules.
👉 Read our full editorial: Joiner-mover-leaver governance now extends to physical access