Identity & Access · Chapter 3 of 16
The lifecycle — joiner, mover, leaver
The least fashionable part of identity and the source of the most real exposure.
Identity governance lives or dies on one asymmetry: granting access is easy, automated and welcomed, while removing it is manual, invisible and nobody's priority.
Where each stage actually fails
| Stage | The real failure | What to check |
|---|---|---|
| Joiner | Access copied from a colleague — “give them what Priya has” | Are grants role-derived, or cloned from a person? |
| Mover | The old access is never removed | Does a role change trigger revocation, or only addition? |
| Leaver | HR termination does not reach every system | Time from termination to last access revoked, measured |
| Contractors | No HR record, so no lifecycle at all | Who owns non-employee identities? Is there an end date? |
| Service accounts | No owner, no expiry, no review | Can you name a human owner for each one? |
The contractor and service-account rows are where audits find the worst material. Both sit outside the HR-driven process that the rest of the lifecycle depends on, so both accumulate silently and neither appears in the metrics anyone reports.
Why access reviews fail, and what to do instead
The standard control is a periodic access review: send managers a list, ask them to confirm. It fails predictably, because a manager facing 400 entitlements with cryptic technical names and a deadline will approve all of them. This is rubber-stamping, and a rubber-stamped review is worse than none because it produces evidence of a control that is not operating.
- Review by exception — show what changed and what is unused, not the full list.
- Lead with usage data. “These 40 entitlements have not been used in 180 days” is a decision a manager can actually make.
- Make revocation the default for unused access, with a simple path to reclaim it.
- Prefer time-bounded grants so access expires without anyone having to decide — which converts an unreliable human control into an automatic one.
Where joiner-mover-leaver actually breaks
Every organisation can create accounts. The failures are concentrated in the other two transitions, and they compound quietly over years.
- Mover is the hardest and the most neglected. Someone changes team and gains the new access; almost nobody removes the old. Over a decade of internal moves, long-tenured employees accumulate the union of every role they have held — which is usually the largest concentration of privilege in the company and belongs to nobody's threat model.
- Leaver is fast for the obvious systems and slow for the rest. The directory account is disabled within minutes. The software-as-a-service tool bought on a departmental card, the personal access token in a code host, the shared credential in a runbook, the external collaborator invite — those persist, sometimes indefinitely.
- Contractors and non-employees are the real gap. They frequently sit outside the human-resources system that drives the whole process, so there is no authoritative event to trigger deprovisioning. Every access-review finding list is disproportionately contractors.
- Service accounts created by a person who has left are the classic orphan: still working, still privileged, owned by nobody, and too frightening to disable because nothing documents what depends on them.
The measurement that finds the truth is not a policy question. It is a timestamp.
“Pick five people who left in the last quarter. For each system, what is the gap between their termination time and the time their access actually ended?”
Almost nobody has computed this, and the distribution is always the finding: a handful of systems in minutes, a long tail in days or weeks, and one or two where the answer turns out to be never.
The reason the number is bad is structural, not cultural. Deprovisioning is driven from an authoritative source of truth, and every system not connected to it requires a human to remember. Humans remember the systems they use.
So the fix is coverage, not diligence: count how many systems are automatically provisioned from the authoritative source versus how many are manual, and treat that ratio as the actual programme metric. It goes up with integration work and it does not go up with training.
And on access reviews: a review where the reviewer's cheapest action is to approve everything will produce approval of everything. Rubber-stamping is a design failure, not a compliance failure. The reviews that work show the manager what changed since last time and what has not been used in ninety days — because a short list of unused privilege is a decision a busy person can actually make, and a list of four hundred entitlements is not.
Check yourself