Because access changes after the initial grant. People move roles, change responsibilities, and leave the organisation, so the control must include reprovisioning and deprovisioning, not just onboarding. Without lifecycle governance, permissions outlive the business need that justified them and privilege creep becomes normal.
Why lifecycle governance belongs beside access provisioning
Access provisioning answers the question “who gets access now,” but IAM also has to answer “should that access still exist later.” Roles change, projects end, approvals expire, and users leave. lifecycle governance keeps permissions aligned to current business need, so entitlements are reviewed, adjusted, and removed before they become stale access.
The distinction matters because a one-time grant is only safe if the access state is continuously kept in sync with the person’s job, the system’s purpose, and the organisation’s risk tolerance. Without lifecycle controls, provisioning creates access faster than the business can justify it, which is how privilege creep becomes routine rather than exceptional.
Lifecycle governance also gives IAM a control boundary that provisioning alone cannot provide. Provisioning is transactional, while governance is ongoing: it covers movers, leavers, recertification, ownership, and exceptions. That broader scope is what makes access decisions auditable and reversible instead of permanent by default.
What changes after the initial grant
The security problem is not the original approval, it is the drift that follows it. A user may move teams, inherit a new manager, take on a temporary assignment, or stop using an application entirely, and each of those changes can make the original entitlement too broad, redundant, or obsolete. Provisioning does not detect that drift on its own.
Lifecycle governance turns access from a static event into a managed state. It requires the organisation to know who owns the entitlement, what business purpose it serves, when it should be revalidated, and what signal should trigger removal or downgrade. That is the only way to keep access proportional to the current role rather than the historical request.
For IAM programmes, this is the difference between granting access based on a moment in time and governing access over its full useful life. The control has to cover joiner, mover, and leaver conditions, because each of those moments changes whether the entitlement is still justified.
Why provisioning alone creates hidden security debt
Provisioning without lifecycle governance accumulates access debt. The immediate workflow succeeds, but the environment gradually fills with accounts, roles, and permissions that no longer match actual job duties. Over time, that weakens least privilege, complicates audits, and raises the chance that old access will be abused, whether intentionally or accidentally.
Lifecycle governance is also what makes deprovisioning credible. If leavers are not removed promptly, or if movers keep their old role-based access, the organisation ends up with dormant entitlements that still authenticate and authorize actions long after the original need has gone. That is a governance failure, not just an administrative delay.
IAM and IGA Basics is useful here because it frames provisioning, reviews, and entitlement governance as one control system rather than separate tasks.
Joiner-Mover-Leaver (JML) Guide is the practical model for keeping access aligned to personnel changes instead of treating onboarding as the end of the process.
Access Reviews and Certification Guide shows how recertification closes the loop when provisioning has already happened and access must be proved current.
Risk and Threat Considerations
When lifecycle governance is missing, stale entitlements become a durable attack surface. Old roles, unrevoked access, and forgotten accounts can let an attacker or insider use permissions that no longer have a current business justification, which widens blast radius after initial compromise and makes detection harder.
Failure mechanism: Access is granted once, but movers and leavers are not fully re-evaluated, so entitlements persist past the point where they are justified. That creates privilege creep, orphaned access, and a larger set of valid paths for misuse or lateral movement.
Impact: The organisation loses control over who can still do what, increasing the likelihood of unauthorized access, audit findings, and avoidable exposure from accounts that should have been reduced or removed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Lifecycle governance is account lifecycle control beyond initial provisioning. |
| IA-5 — Authenticator Management | Provisioning and deprovisioning often depend on credential lifecycle, not just access grants. | |
| AC-6 — Least Privilege | Lifecycle governance prevents permissions from persisting after business need changes. | |
| Recommendation — Define account states, review triggers, and timely removal conditions for changed or departed users. Rotate or revoke authenticators when access should no longer remain valid. Continuously reduce entitlements to the minimum current business need. | ||
| CIS Controls v8 | CIS-5 — Account Management | The question centers on managing accounts across joiner, mover, and leaver states. |
| Recommendation — Inventory accounts, remove stale access, and enforce timely deprovisioning. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | Lifecycle governance ensures access rights are provisioned, reviewed, and removed as needed. |
| Recommendation — Review, adjust, and revoke access rights throughout the user lifecycle. | ||
Practitioner Guidance
What to prioritise: Treat movers and leavers as the highest-value lifecycle checkpoints, not just onboarding. If a person’s role, manager, or system ownership changes, that should trigger a fresh access decision, not a passive assumption that the old access still fits.
What to verify: Make sure every entitlement has an owner, a business purpose, and a review path. If you cannot explain why an account still exists or who is accountable for it, the access is already beyond normal governance.
Common mistake: Teams often measure provisioning speed and call the IAM process successful, while ignoring whether access is later removed, downgraded, or recertified. Fast issuance without lifecycle control just front-loads risk.
Practitioner takeaway: Provisioning gets access started, but lifecycle governance decides whether that access remains defensible over time. The stronger programme is the one that can remove or reshape access as reliably as it can create it.
Related resources from NHI Mgmt Group
- Who should own lifecycle governance across IAM and access controls?
- How should IAM teams choose between lifecycle workflow coverage and stricter access governance?
- Who should own privileged access governance across IAM, PAM, and lifecycle processes?
- Who should be accountable for lifecycle governance across IAM and privileged access?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 8, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org