Identity Governance

Joiner–Mover–Leaver automation: closing identity's most exploited gaps

  • Dinesh Kumar
  • Last updated
  • 3 min read

Audit findings about access rarely start with technology. They start with a moment: an employee transferred departments and kept the old access; a contractor's engagement ended but their account didn't; a new hire waited two weeks for system access and the team 'solved' it with a shared login.

These are lifecycle failures — joiner, mover, leaver — and they're endemic wherever the process is email-and-memory. The fix isn't discipline. It's removing the human relay from the loop.

What good looks like

In a mature JML setup, your HR system is the single source of truth. A new hire record triggers account creation, role-based access assignment and a welcome notification before day one. A transfer triggers simultaneous grant-and-revoke — the new role's access arrives as the old role's access leaves, which is the only reliable way to prevent privilege accumulation. A separation triggers immediate deprovisioning across every connected system, including the ones without APIs, where a ticketing-workflow integration ensures a human completes and documents the removal.

Approval workflows handle the exceptions — access outside the standard role model — so the fast path stays fast and the unusual path stays governed.

Where to start

Start with leavers: it's the highest-risk transition and the easiest to automate because the trigger (HR separation) is unambiguous. Then movers, which quietly generate most SoD violations. Joiners last — they're a productivity win more than a risk win.

Measure three numbers before and after: time-to-productive-access for joiners, residual-access count for movers (entitlements from previous roles), and time-to-full-deprovisioning for leavers. Those three metrics tell the whole story to any board or auditor.

Frequently asked questions

What is Joiner-Mover-Leaver automation?

Driving access changes from the HR record rather than from email and memory: a new hire record triggers account creation and role-based access before day one, a transfer triggers simultaneous grant-and-revoke, and a separation triggers immediate deprovisioning across every connected system.

Which transition should we automate first?

Leavers. It's the highest-risk transition and the easiest to automate, because the trigger — an HR separation record — is unambiguous. Movers come next, since they quietly generate most Segregation of Duties violations, and joiners last.

How do you handle systems that have no API?

Through a ticketing-workflow integration, so a human completes the removal and the completion is recorded — the access change is still governed and evidenced even where it can't be executed directly.

What should we measure to show the automation worked?

Time-to-productive-access for joiners, residual-access count for movers (entitlements left over from previous roles), and time-to-full-deprovisioning for leavers. Those three numbers tell the whole story to a board or an auditor.

Where do approval workflows fit?

They handle the exceptions — access outside the standard role model — so the fast path stays fast and the unusual path stays governed.