Joiners, movers, and leavers is the standard identity operations model for onboarding new users, updating access when roles change, and removing access when people exit. It is a core governance workflow because each transition can create access sprawl, orphaned accounts, or privilege mismatch if controls are not automated.
Expanded Definition
Joiners, movers, and leavers, often abbreviated as JML, is the lifecycle control model for identity operations across onboarding, role change, and offboarding. In NHI governance, the same concept applies to service accounts, API keys, workload identities, and agent credentials, not just human users. The operational goal is to keep identity state aligned with business state so access is issued only when needed, adjusted when context changes, and removed when authority ends.
Definitions vary across vendors on how much of JML should be automated, but the governance intent is consistent: prevent standing access from lingering after a role shift or departure. This aligns with NIST Cybersecurity Framework 2.0, which emphasises identity management, access control, and continuous governance. For NHIs, JML also includes credential rotation, owner reassignment, and dependency checks so that automation does not break services when access is removed. The most common misapplication is treating JML as an HR-only workflow, which occurs when teams update employee records but fail to revoke or rebind the machine identities tied to those accounts.
Examples and Use Cases
Implementing JML rigorously often introduces process overhead and dependency mapping effort, requiring organisations to weigh faster access changes against the cost of tighter governance.
- Joiner: a new CI/CD service account is created with scoped permissions, stored in a controlled secrets system, and tagged to an owner for later review. This reflects the lifecycle discipline discussed in the Ultimate Guide to NHIs.
- Mover: a platform engineer changes teams, so the old deployment token is removed and a new token is issued with the permissions needed for the new environment.
- Leaver: when a contractor exits, API keys, certificates, and any delegated access paths are revoked together rather than one system at a time.
- Agent lifecycle: an autonomous agent is re-assigned from testing to production, and its tool access is revalidated before the move is approved.
- Cross-system sync: identity governance workflows trigger changes in IAM, PAM, ticketing, and secret stores so that access state stays consistent across platforms.
Why It Matters in NHI Security
JML is a control point for reducing orphaned accounts, privilege mismatch, and hidden access paths that accumulate as environments change. In NHI programmes, failure usually starts with incomplete offboarding or a rushed role change, then spreads into stale secrets, excess entitlements, and unclear ownership. NHI Mgmt Group research shows that only 20% of organisations have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, which makes JML a practical governance gap rather than a theoretical one. That gap becomes more dangerous when identities are shared across pipelines, apps, and agents, because one missed transition can preserve access long after the business relationship has ended.
JML also supports Zero Trust and least privilege by ensuring access is continuously re-evaluated instead of inherited indefinitely. Without it, teams often discover that access was never removed until an audit, incident response, or system migration forces a review. Organisaties typically encounter the operational cost of JML failure only after a departure, role change, or breach review, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Covers NHI lifecycle governance, including creation, change, and revocation of machine identities. |
| NIST CSF 2.0 | PR.AA | Identity and access management controls align with lifecycle-based access changes and revocation. |
| NIST Zero Trust (SP 800-207) | SC.DP | Zero Trust requires access decisions to reflect current identity state and context. |
| NIST SP 800-63 | Identity proofing and authenticator management inform lifecycle changes for digital identities. | |
| CSA MAESTRO | Agentic systems need lifecycle governance for agent identity, tools, and delegation. |
Automate NHI joiner, mover, and leaver workflows so every identity change updates access and ownership.
Related resources from NHI Mgmt Group
- How should security teams govern NHI access across joiners, movers, and leavers?
- How should security teams automate access changes for joiners, movers, and leavers?
- Who should own lifecycle workflows across joiners, movers, and leavers?
- Why do movers create more identity governance risk than joiners and leavers?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
