Lifecycle management breaks when teams rely on spreadsheets and manual approvals because the process cannot keep pace with app growth, role changes, and employee movement. The common result is slow onboarding, clunky access reviews, delayed offboarding, and excessive ticket volume. Over time, that creates backlogs, inconsistent decisions, and access that remains in place longer than intended.
Why Spreadsheet-Based Lifecycle Management Breaks
Lifecycle management sounds simple until the organisation has too many applications, too many exceptions, and too much change for a human-driven tracker to keep up. Spreadsheets can record intent, but they do not enforce timing, ownership, evidence, or revocation. Manual approvals add another weak point: they often turn access decisions into a queue of detached reviews rather than a controlled workflow with auditability and expiration.
That is where delay becomes exposure. When onboarding, transfers, and offboarding all depend on people updating rows, chasing approvers, and reconciling versions, the process becomes vulnerable to stale access and inconsistent decisions. NHIMG research on lifecycle failures shows why this matters in practice: only a minority of organisations have formal offboarding and revocation processes for API keys, and service-account visibility is often poor. In practice, many security teams discover the weakness only after access has already remained active longer than intended, not during the approval process itself.
For teams managing machine and human access together, the problem is not just administrative inefficiency. It is that spreadsheet governance has no built-in control over revocation order, approval freshness, or whether the person approving still has the right context. The result is a process that can look organised while quietly accumulating outdated entitlements.
How It Fails in Day-to-Day Operations
The failure pattern usually starts with a spreadsheet acting as the system of record, while tickets, email threads, and chat approvals become the execution layer. That split creates version drift: the sheet says one thing, the ticket says another, and the actual directory or application state may say something else entirely. When someone changes role, leaves a team, or exits the organisation, the manual process depends on a person noticing the change, updating the row, and pushing the right follow-up actions in the right order.
That approach breaks down because lifecycle work is not a one-time approval problem. It is a continuous state-management problem. Access needs to be granted, reviewed, reduced, rotated, and revoked with timing attached to each step. Spreadsheets can document those steps, but they cannot reliably enforce them. A delayed approval may be tolerable for low-risk access, but for privileged or shared access it creates a period where the organisation believes a control exists even though the underlying entitlement still does.
Practitioners usually see the same operational symptoms:
- requests sit in queues because approvers are unavailable or unclear about ownership;
- access reviews become checkbox exercises because the evidence is scattered across files and inboxes;
- offboarding misses long-tail accounts because the tracker does not surface every dependent system;
- manual reconciliation takes longer than the change window, so stale access survives the transition.
NHIMG’s lifecycle guidance and related research on NHI Lifecycle Management Guide and the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs both point to the same structural issue: lifecycle control fails when review and enforcement are separated. External guidance is consistent as well; the NIST Cybersecurity Framework 2.0 emphasizes managed governance and access processes rather than ad hoc recordkeeping.
These controls tend to break down when entitlement changes span many applications or non-human identities because no spreadsheet can reliably track every dependency, exception, and revocation deadline at once.
Common Variations and Edge Cases
Tighter approval handling often increases administrative overhead, so organisations have to balance speed against assurance. That tradeoff becomes more painful in distributed environments where access decisions involve both business managers and technical owners, or where the same account is reused across multiple systems. In those cases, a manual approval may be technically recorded but still operationally incomplete if it does not trigger the downstream update everywhere the access exists.
One common edge case is low-frequency access. Teams assume that because access is used rarely, it can be managed casually. In reality, dormant access is often harder to notice, which means a stale approval can persist long after it has ceased to be justified. Another edge case is emergency access: a spreadsheet can record an exception, but it rarely gives a clean way to enforce expiry, revisit the exception, and prove that the temporary privilege was removed.
For NHI-heavy environments, the stakes rise further because secrets, tokens, and service accounts do not wait for a quarterly review cycle. NHIMG research on Guide to the Secret Sprawl Challenge and Guide to NHI Rotation Challenges is especially relevant where manual approval culture creates delay instead of control. The practical rule is simple: if the process cannot prove who approved, what changed, and when it expires, it is not lifecycle management but recordkeeping.
Risk and Threat Considerations
Spreadsheet-based lifecycle management creates exposure through stale entitlements, weak revocation discipline, and poor visibility into who still has access after a role change or departure. That matters because long-lived access paths are attractive to both insiders and external attackers, especially when approvals are delayed or inconsistently applied.
Failure mechanism: Manual approvals rely on human follow-through across multiple systems, so access can remain valid after the business need has ended. Attackers and opportunistic insiders benefit from this gap by using abandoned accounts, lingering tokens, or overprivileged access that was never formally removed.
Impact: The likely consequence is unauthorised persistence, broader blast radius, failed audits, and delayed containment when access must be revoked quickly. In non-human identity environments, that can translate into exposed service accounts, stale secrets, and hard-to-trace privilege that survives the workflow that was supposed to remove it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 5 — Account Management | Manual lifecycle approval errors often leave stale accounts and access paths active. |
| 6 — Access Control Management | Spreadsheets cannot reliably enforce least-privilege approval and review decisions. | |
| 8 — Audit Log Management | Manual approvals weaken evidence trails and make lifecycle actions hard to verify. | |
| Recommendation — Automate account lifecycle updates and remove stale access promptly. Centralise access control decisions and enforce approved entitlements in-system. Log approval, change, and revocation events so lifecycle actions remain auditable. | ||
| NIST CSF 2.0 | PR.AA — Identity Management, Authentication, and Access Control | The issue is failure to manage identities and access across their full lifecycle. |
| GV.PO — Policy | Spreadsheet workflows often reflect policy intent without reliable operational enforcement. | |
| DE.CM — Continuous Monitoring | Manual tracking obscures stale access and delays detection of lifecycle drift. | |
| Recommendation — Govern access lifecycles through automated identity and entitlement controls. Define lifecycle policy that requires enforced approvals, expiry, and revocation. Monitor entitlement drift and alert on access that outlives its approved purpose. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Management | Lifecycle failures often leave machine credentials and secrets active beyond need. |
| NHI-02 — Access Governance | Manual approvals are a weak control for governing non-human access decisions. | |
| NHI-06 — Lifecycle Management | The question directly concerns lifecycle management failure and stale access persistence. | |
| Recommendation — Track, rotate, and revoke machine secrets through enforced lifecycle controls. Apply governed approval and review processes to machine access decisions. Automate provisioning, review, and offboarding to prevent stale non-human access. | ||
Practitioner Guidance
What to prioritise: Treat revocation and ownership clarity as the first control objective, not the last cleanup step. If an access path cannot be tied to a current owner and an expiry condition, it should be flagged before the next approval cycle rather than after it.
What to verify: Check whether every approval actually drives a downstream state change in the identity or application system of record. A spreadsheet entry alone is not evidence that access was granted, reduced, or removed; the control only exists when the operational system reflects it.
Common mistake: Teams often optimise for approval completeness while ignoring closure completeness. That creates a false sense of governance because requests look reviewed even when offboarding, rotation, and exception expiry are still unresolved.
Practitioner takeaway: Manual approval records can support governance, but they cannot substitute for enforced lifecycle state, especially once access spans multiple systems or non-human identities.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
