Joiner-Mover-Leaver (JML) Guide: People and NHIs

Joiner-mover-leaver (JML) processes decide how access is granted when people arrive, changed when they move and removed when they leave. They sound administrative, but they drive a large share of identity risk. Leavers whose accounts stay active, movers who keep every entitlement from every role they have held, and contractors whose access outlives their contracts are some of the most common audit findings and a frequent route for insider misuse. JML also shapes non-human identity risk: when an employee leaves, the service accounts, API keys, tokens and AI agents they created often stay behind. This guide covers how to design, automate and measure JML for people and the NHIs connected to them.

Key takeaways

Drive JML from an authoritative source, usually HR for employees and a vendor management system for contractors.
Automate provisioning and deprovisioning wherever possible; manual steps are where delays and gaps appear.
Movers are the hardest case: remove access tied to the old role, not just add access for the new one.
Leaver processes must include NHIs: personal access tokens, API keys, OAuth grants, owned service accounts and AI agents.
Measure time to deprovision and orphaned access, and reconcile regularly.

Joiners

Create identities automatically from HR records before the start date, activated on day one.
Grant birthright access based on role, department and location, using well-defined roles. See the Role Mining and Role Design Guide.
Use secure onboarding for first authentication, such as a temporary access pass leading to phishing-resistant enrolment. See the Passwordless and Passkeys Guide.
Route additional access through requests with approval, not ad hoc administrator grants.

Movers

Trigger mover events from HR changes: job, department, manager, location, employment type.
Recalculate birthright access: add new, remove old.
For requested access tied to the old role, either remove it automatically after a grace period or trigger a manager review. See the Access Reviews Guide.
Check for segregation of duties conflicts created by combining old and new access. See the Segregation of Duties Guide.
Transfer ownership of NHIs, applications and data the person owned in their previous role.

Leavers

Disable the primary identity at or before the leaving time; for high-risk leavers, disable immediately on notice.
Revoke active sessions and refresh tokens, not just the password, so existing sessions end.
Deprovision downstream accounts, including those in applications not connected to SSO.
Remove privileged access and vault credentials the person knew; rotate shared credentials they had access to.
Recover devices and security keys.

The non-human side of leavers

People create and hold NHIs. When they leave, those NHIs become orphaned or remain usable by someone who should no longer have access. OWASP lists this as NHI1 Improper Offboarding. The Coupang signing key breach was traced to credentials not revoked after an employee's offboarding. Leaver processes should:

Revoke personal access tokens and API keys in code platforms, cloud consoles and SaaS.
Revoke OAuth grants the person made to third-party apps and AI tools.
Rotate secrets the person could access, such as shared service account passwords and keys in team vaults.
Reassign ownership of service accounts, app registrations, API keys and AI agents they owned. See the NHI Ownership and Accountability Guide.
Check for AI agents or automations running with the person's credentials, and move them to proper identities. See the Agentic AI Identity Guide.

Contractors, partners and other non-employees

Use a sponsor model: each non-employee has an employee sponsor accountable for their access.
Set end dates on every non-employee identity, with automatic disablement and renewal requiring sponsor action.
Use a system of record for non-employees, not spreadsheets.

Automation and reconciliation

Connect HR and non-employee systems to an IGA or IdP lifecycle engine. See the IGA Buyer's Guide.
Use SCIM and connectors to provision and deprovision applications.
For disconnected applications, generate tracked tasks with deadlines.
Reconcile regularly: compare accounts in each application with the authoritative source to find orphaned and unauthorised accounts.

Metrics

Time from HR leave date to full deprovisioning, especially for privileged users.
Number of active accounts belonging to leavers found in reconciliation.
Number of NHIs owned by leavers, and time to reassign.
Percentage of applications provisioned automatically.
Mover access removal rate.

Practitioner checklist

Use HR and non-employee systems of record as authoritative sources.
Automate joiner provisioning with role-based birthright access and secure onboarding.
Remove old-role access for movers and check SoD conflicts.
Disable leavers promptly, revoke sessions and tokens, and deprovision downstream accounts.
Include NHIs in leaver processing: tokens, keys, OAuth grants, owned service accounts and AI agents.
Set end dates and sponsors for non-employees.
Reconcile applications against authoritative sources regularly.

Standards and references

OWASP Non-Human Identities Top 10 (2025): NHI1 Improper Offboarding
RFC 7644: SCIM Protocol
NIST SP 800-53 Rev. 5 (AC-2 Account Management, PS-4 Personnel Termination, PS-5 Personnel Transfer)
ISO/IEC 27001:2022

Related NHI Mgmt Group resources: IAM and IGA Basics · Workforce Identity Security Guide · NHI Lifecycle Management Guide · Access Reviews Guide