Because the process may be present while the enforcement is delayed. Users gain new access during role changes, projects, and re-engagements, while old access remains in place until a later review or manual cleanup. The gap is not process absence. It is the delay between policy intent and effective revocation.
Why access debt builds up even when JML exists
Joiner-mover-leaver processes can be formally in place and still leave a growing access backlog if the operational reality is slower than the policy. Access debt appears when entitlements are added quickly for business continuity but removed later, after review, ticket closure, or manual cleanup. The control exists, yet the effective revocation happens too late to prevent excess exposure.
That gap matters because access changes are not one event. A person can move roles multiple times, return from leave, join a new project, or re-enter through a contractor or rehire path, and each transition can accumulate permissions faster than they are retired. Over time, the environment contains more access than current need justifies, even though the JML workflow is technically functioning.
The practical issue is that JML is only as strong as its handoff points, timing, and ownership. If HR, managers, application owners, and IAM teams do not close the loop quickly, stale access remains available long after the business reason has passed. That creates a lag between entitlement intent and entitlement reality.
How delayed removal turns process coverage into exposure
Access debt is especially risky because excess permissions are usually quiet until they are not. Old access may not break workflows, which makes it easy to ignore, but every dormant entitlement expands the blast radius of account compromise, misuse, or simple human error. The risk is not just unused access, it is reachable access that no longer reflects current job need.
For access lifecycle discipline, the most relevant failure mode is delayed revocation across the same recurring patterns that JML is meant to handle. NHIMG’s Joiner-Mover-Leaver (JML) Guide is useful here because it frames the control as more than onboarding and offboarding, it also covers the removal of old-role access that often becomes hidden debt.
When that debt accumulates, it is rarely limited to human users. Long-lived entitlements, shared administrative paths, and machine-facing access can all remain active after the original need ends. NHIMG’s IAM and IGA Basics is a good companion reference because it ties provisioning, entitlement governance, and access review together, which is where delayed cleanup usually becomes visible.
In practice, the longer the delay, the more likely a later role change or rehire event will stack new access on top of old access instead of replacing it. That is how a working process can still create privilege creep, dormant access, and ownership confusion without ever appearing as a formal control failure.
Why the risk grows with scale and repeated transitions
Access debt compounds when change volume is high. Teams with frequent promotions, transfers, project-based access, contractors, and temporary exceptions can generate many small access remnants that are individually defensible but collectively unsafe. The result is not a single broken workflow, but a portfolio of stale access paths that are hard to notice in day-to-day operations.
The other common scaling problem is that cleanup is often manual while granting is automated. That asymmetry creates a structural lag: access is easy to add for productivity, but harder to prove unnecessary and harder still to remove everywhere it exists. The more systems, roles, and approvals involved, the more likely the organization will carry residual access for weeks or months.
NHIMG’s Access Reviews and Certification Guide is relevant because it focuses on closing the loop, not just running a review campaign. It helps explain why access debt persists when recertification exists in theory but does not reliably trigger removal in production systems.
Risk and Threat Considerations
Access debt increases the chance that a compromised or misused account can reach more systems than current job function requires. It also increases the chance that former, dormant, or temporarily borrowed access remains usable after the business need has ended, which gives both insiders and external attackers more room to operate.
Failure mechanism: Access is granted quickly for business continuity, but revocation depends on delayed reviews, incomplete inventory, or manual follow-up, so unused entitlements survive role changes and offboarding.
Impact: The organization carries unnecessary privilege, larger blast radius, and more paths for unauthorized action, which raises the cost and urgency of any later incident response.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0, CIS Controls v8 and OWASP ASVS set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | JML debt is an account lifecycle issue that AC-2 directly governs. |
| IA-5 — Authenticator Management | Delayed cleanup often leaves stale credentials or tokens active after role changes. | |
| AC-6 — Least Privilege | Access debt increases privilege beyond current task need, which AC-6 is meant to prevent. | |
| Recommendation — Automate account removal and periodic review to keep entitlements aligned with current need. Track credential lifecycle tightly and revoke or rotate authenticators when access changes. Limit access to current job function and remove excess permissions as soon as need ends. | ||
| NIST CSF 2.0 | PR.AA-05 — Least Privilege | The question centers on excess access persisting after changes, a least-privilege failure. |
| ID.IM-01 — Improvements are identified and prioritized | Access debt appears when revocation gaps are found but not systematically closed. | |
| Recommendation — Continuously reduce standing access so moved or departed users do not retain unnecessary rights. Track recurring JML delays as improvement items and drive them to closure. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | Residual access after role changes is directly an access-rights governance problem. |
| Recommendation — Review, remove and reassign access rights promptly when roles or employment status change. | ||
| CIS Controls v8 | CIS-5 — Account Management | The topic is about controlling lifecycle drift in user and privileged accounts. |
| Recommendation — Maintain accurate account inventories and remove stale access as part of account management. | ||
| OWASP ASVS | V8 — Authorization | Stale permissions create authorization excess beyond current business need. |
| Recommendation — Ensure authorization is continuously revalidated against current role and resource need. | ||
Practitioner Guidance
What to prioritize: Treat access debt as a lifecycle control problem, not a review-program problem. The fastest way to reduce risk is to shorten the time between a role change and the actual removal of no-longer-needed access, especially for privileged or business-critical systems.
What to verify: Confirm that every JML transition produces an explicit removal signal, not just a ticket or attestation record. The evidence that matters is whether old access disappears from the target system, not whether the request was opened or approved.
Common mistake: Teams often assume periodic access reviews will clean up everything later. That is too slow for high-churn environments, where the safer pattern is immediate or near-immediate enforcement with review used as a backstop, not the primary revocation mechanism.
Practitioner takeaway: A functioning JML process is not enough if revocation is lagging, because access debt is created by delay, not by policy absence.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 13, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org