Lifecycle policy

Expanded Definition

Lifecycle policy defines the state changes, retention window, and end-of-life action for a resource such as a secret, token, certificate, or service account. In NHI operations, it is not just a cleanup rule. It is a governance control that limits how long access can exist before renewal, revocation, or deletion becomes mandatory.

For Non-Human Identities, lifecycle policy is closely tied to rotation, expiration, deprovisioning, and auditability. A strong policy says when a credential becomes invalid, who can extend it, and what evidence must exist before an extension is approved. That distinction matters because a policy can be well written but still fail if it is not enforced by systems that actually terminate access. NHI Management Group treats lifecycle discipline as part of broader lifecycle governance, as covered in the NHI Lifecycle Management Guide and the OWASP Non-Human Identity Top 10.

Definitions vary across vendors when lifecycle policy is discussed alongside retention, rotation, and expiry, so organisations should treat it as a control boundary rather than a generic housekeeping rule. The most common misapplication is assuming a policy exists because a vault or platform can expire objects, which occurs when expiration is configured but not linked to ownership, approval, and downstream revocation.

Examples and Use Cases

Implementing lifecycle policy rigorously often introduces operational friction, requiring organisations to weigh stronger control over temporary assets against the cost of renewals, approvals, and service interruptions.

• A short-lived API key is issued for a deployment pipeline and automatically expires after the release window closes, reducing the chance that a forgotten credential becomes permanent access.
• A certificate policy forces renewal before expiry and revocation after service decommissioning, preventing stale trust relationships from persisting beyond their intended use.
• A service account created for a one-time migration is tied to an offboarding workflow so that access is removed when the migration completes, not weeks later.
• A secrets manager applies retention rules to old versions so that superseded credentials are deleted after validation, limiting exposure if older copies were duplicated elsewhere, a pattern explored in the Guide to the Secret Sprawl Challenge.
• A cloud workload identity is configured with a renewal path that requires fresh attestation before extension, aligning operational continuity with the NIST Cybersecurity Framework 2.0.

Lifecycle policies become most valuable when the resource has a predictable end state and an accountable owner. They are especially useful for temporary access, build artifacts, machine certificates, and delegated tokens that should not survive the task they were created to support.

Why It Matters in NHI Security

Lifecycle failure is one of the fastest ways for temporary access to become standing access. In the NHI domain, expired credentials that are not revoked, rotated identities that remain active, and certificates that outlive the workload they protect all create hidden attack paths. NHI Management Group research shows that 91% of former employee tokens remain active after offboarding, which illustrates how quickly lifecycle gaps turn into security exposure when ownership and enforcement are weak.

Good lifecycle policy also supports least privilege and Zero Trust by ensuring access is time bounded rather than assumed to be permanent. This matters for secret sprawl, third-party access, and automation pipelines because every unmanaged extension increases the chance that a token or service account will be reused outside its intended context. The Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs and the Ultimate Guide to NHIs — Regulatory and Audit Perspectives both show that lifecycle evidence is central to audit readiness, not an optional administrative detail.

Organisations typically encounter the consequences only after a decommissioned system, offboarded user, or exposed secret is abused in an incident, at which point lifecycle policy becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Policy lifecycle
• How does NHI lifecycle management differ from human identity lifecycle management?
• What is the difference between runtime protection and NHI lifecycle management?
• When does policy-based access control reduce risk for NHI environments?