The joiner-mover-leaver process manages identity changes across the full employee lifecycle. In IAM, it provisions access when someone joins, adjusts privileges when roles or responsibilities change, and removes accounts, credentials, and permissions when they leave, reducing orphaned access and supporting least privilege, auditability, and governance.
How the joiner-mover-leaver process works
The joiner-mover-leaver process is an identity lifecycle control, not a single workflow. It links HR or source-of-truth changes to access provisioning, privilege adjustment, and deprovisioning so access reflects the person’s current role and status.
Its strength is that it treats onboarding, internal movement, and exit as one governed lifecycle. That reduces the gaps that appear when joiners receive too much access by default, movers keep old-role permissions, or leavers retain active accounts after departure.
Why JML matters for access governance
JML is where least privilege becomes operational. It helps organisations move from static access grants to access that is continuously aligned with job function, approval state, and employment status.
When JML is effective, it supports cleaner audit trails because each access change has a business reason and a lifecycle trigger. That matters for entitlement review, segregation of duties, and proving that access did not outlive the need for it.
What JML must manage across the lifecycle
A mature process does more than create and delete accounts. It also handles role changes, delegated access, application entitlements, privileged access, shared access patterns, and any credentials or tokens that remain valid beyond the employment event.
That is why JML is often tied to identity governance, HR-driven provisioning, and account reconciliation. If the organisation only provisions at join time and forgets to recertify on move or leaver events, entitlement creep and orphaned access build up quietly over time.
Where JML fails in practice
JML usually fails at handoffs and exceptions. Common breakpoints include inaccurate source data, manual approvals that lag behind role changes, inconsistent deprovisioning across applications, and exceptions that are never revisited.
The result is often access that no longer matches the business need. Over time, that creates more than just clutter, it can leave dormant accounts, excessive privilege, and unowned credentials in systems that are easy to forget and hard to audit.
Risk and Threat Considerations
Joiner-mover-leaver weaknesses create a straightforward exposure pattern: access is granted faster than it is removed, and attackers or insiders can exploit that delay. The risk increases when departures, contractor exits, or role changes are not synchronised across every system that issues access.
Failure mechanism: Orphaned accounts, stale entitlements, and unreconciled credentials preserve access after the legitimate need has ended, which gives a former user, attacker, or impersonator a longer window to abuse trust.
Impact: This can lead to unauthorized access, privilege misuse, data exposure, and harder incident containment because the organisation may not immediately know which accounts, tokens, or permissions should have been revoked.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | JML governs the lifecycle of credentials and authenticators as people join, move, or leave. |
| AC-2 — Account Management | JML is the operational account lifecycle process for provisioning, changes, and deprovisioning. | |
| Recommendation — Apply IA-5 to rotate, revoke, and retire authenticators when lifecycle events change access needs. Use AC-2 to automate account creation, modification, suspension, and removal across the full lifecycle. | ||
| CIS Controls v8 | CIS-5 — Account Management | JML directly maps to account lifecycle governance and orphaned account reduction. |
| Recommendation — Implement account inventory and lifecycle controls to remove stale access when users change roles or exit. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access Control | JML exists to ensure access is granted, changed, and removed under governed access control. |
| A.5.16 — Identity Management | JML manages identity changes across onboarding, role change, and offboarding. | |
| Recommendation — Define access control rules that tie provisioning and deprovisioning to approved lifecycle events. Maintain authoritative identity records so role changes and departures propagate consistently. | ||
Practitioner Guidance
Governance implication: Treat JML as a control that depends on accurate ownership and a reliable source of truth. If HR, managers, application owners, and IAM teams do not share the same lifecycle trigger, the process degrades into partial automation with inconsistent results.
What to watch for: Pay attention to role changes that are not mirrored in downstream systems, leavers who still authenticate anywhere, and exceptions that bypass deprovisioning. A good JML process is measured by how quickly it removes unnecessary access, not just by how many accounts it creates.
Related resources from NHI Mgmt Group
- Guide: Joiner-Mover-Leaver (JML) Guide
- What breaks when deprovisioning is not tied to the joiner-mover-leaver process?
- What happens when access certifications are not tied to a clear joiner mover leaver process?
- What breaks when a user lifecycle platform does not match the real joiner-mover-leaver process?
- Why do service accounts and API keys complicate joiner-mover-leaver processes?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org