What breaks when JML stops at the digital perimeter?

When JML Stops at the Digital Perimeter

Joiner-mover-leaver only works as a lifecycle control when it follows the person beyond a login. If the process deprovisions accounts but ignores badges, door access, shared spaces, or secure areas, the organisation has split one lifecycle into two records. The result is not just a process gap, it is a governance gap: the person’s real-world access outlives the employment state that was supposed to govern it.

A joiner-mover-leaver process that only covers accounts leaves physical credentials outside the lifecycle record. That means a person can change roles or leave the organisation while badges, floor access, or secure-area rights remain active. The practical failure is incomplete deprovisioning, because identity governance has not actually removed all access.

That split also creates mismatched ownership. HR may mark the worker as a leaver, IAM may revoke network access, but facilities or security operations can still be trusting an old badge or access profile. In practice, that is how stale access survives audits, how exceptions become normal, and how “offboarded” people retain a path into spaces where the digital records say they should no longer exist.

Why Physical Access Must Be Part of the Same Lifecycle

The control problem is simple: physical access is still access. When lifecycle management stops at the digital perimeter, the organisation loses the ability to prove that removal of authority was complete. That matters most when physical entry unlocks assets that account deprovisioning cannot protect, such as offices, labs, sensitive rooms, print areas, or equipment stores.

This is why lifecycle should be treated as one access story, not separate admin tasks. A move event can change what areas someone may enter, not just what systems they may use. A leaver event should remove all credential types that can be used to represent that person, including the badge or token that gates a door. The stronger the control objective, the more important it becomes to reconcile people data, account data, and physical access data as one set. For a broader lifecycle view, Joiner-Mover-Leaver (JML) Guide is the clearest starting point.

Where organisations already recognise the identity governance angle, the same issue is usually discussed as lifecycle completeness and entitlement removal. The practical question is whether the organisation can demonstrate that every access path tied to a person was removed on time, not only the ones that were easiest to automate. IAM and IGA Basics helps frame that broader governance boundary.

For access that persists after offboarding, the failure mode is often visible in the credential itself. A badge, keycard, or site token can remain valid long after the digital account is closed, which is a reminder that lifecycle controls have to include issuance, revocation, and reconciliation across every form of access material. NHI Lifecycle Management Guide covers that lifecycle discipline in more detail.

Where the Breakdown Shows Up Operationally

The first symptom is usually inconsistency across systems. HR says the person has moved or left, the access ticket says the account was closed, but physical security still shows an active door entitlement. That inconsistency matters because it means no single control owner has end-to-end visibility of the person’s access state.

The second symptom is unmanaged residual privilege. A person may no longer need the building, but the badge still works because it was never tied to the offboarding event. Over time, those leftovers accumulate into access creep, and the organisation starts carrying invisible trust in credentials that should have been retired with the role change. The practical consequence is not theoretical: physical access can become the easiest remaining route into sensitive material when digital access has already been removed.

This is also where offboarding failures tend to compound. If the process misses one credential class once, it often misses the same class repeatedly because the workflow was designed around systems of record, not around the actual ways a person enters the premises. That is why the process must be measured by confirmed removal, not by task completion.

Risk and Threat Considerations

When physical credentials survive offboarding, the exposure is unauthorised entry rather than just a paperwork defect. A former employee, contractor, or transferred staff member may still reach restricted areas, observe sensitive activity, or access assets that were assumed to be protected by their departure date.

Failure mechanism: The organisation deprovisions digital accounts but does not synchronise physical badge revocation, so access remains valid in one control plane after authority has ended.

Impact: Residual physical access can enable theft, sabotage, data exposure, tailgating of others, or after-hours presence that bypasses the assumptions behind digital offboarding.

Practitioner Guidance

What to verify: Confirm that every mover and leaver event produces a checked revocation record for each credential class, not just an IT ticket closure. If the badge system, visitor platform, or security desk is outside the same workflow, treat the process as incomplete until those records reconcile.

Common mistake: Teams often assume that removing network access proves offboarding worked. It does not. If a physical credential can still open a controlled area, then the lifecycle control has not reached the real-world boundary where risk still exists.

What good looks like: The organisation can show a single authoritative lifecycle event, prompt revocation across account and physical access systems, and exception handling for any residual credentials that could still grant entry.

Practitioner takeaway: If JML does not cover physical access, you do not have complete deprovisioning, you have only removed one layer of trust while leaving another one active.

Related resources from NHI Mgmt Group

• What breaks when AI agent security stops at the perimeter and does not inspect tool execution and MCP traffic?
• What breaks when identity governance stops at login events?
• What breaks when AI agent monitoring stops at deployment posture?
• What breaks when NHI governance stops at compliance evidence?