Three moments that matter
People do not hold the same job forever. They start, they change role or team, and eventually they leave. Each of these moments has implications for what systems they should be able to reach. Access specialists group them under the shorthand joiner, mover and leaver, and many organizations treat them as a lifecycle with a standard process for each stage.
This article explains what each stage involves and why the middle one tends to cause trouble. It is general information, not security or legal advice.
Joiners
When someone starts, they need enough access to work from day one, and no more than their role requires. Common difficulties are delays, which leave a new starter waiting for accounts, and over-generosity, where someone copies the access of a colleague “to be safe”. Copying a colleague’s access often brings along permissions the colleague gained for earlier projects.
Good practice usually includes:
- A trigger from a reliable source, usually the HR record, so IT does not rely on an email arriving.
- A standard starting package of access defined for each role or team, so requests are predictable. This is where role-based access control helps.
- Manager approval for anything beyond the standard package.
- A clear start date so accounts are ready in time but not active long before.
Contractors and temporary staff are joiners too, and they often have less formal records. Giving each a named sponsor and an end date makes later cleanup much easier.
Leavers
Removing access when someone leaves seems simple, but several things go wrong:
- The notice reaches IT late, or not at all, particularly for contractors.
- Main accounts are disabled but separate accounts remain, such as those in niche applications, shared logins or tools bought by a single team.
- Company data is held in personal accounts or files that nobody has arranged to recover.
- Equipment, tokens and keys are not collected.
- Devices or applications keep an active session after the account is disabled.
Timing matters too. Some departures are friendly and planned, others are sudden, and the process should handle both. In sensitive cases, HR, legal and security teams may need to coordinate; this is a matter for qualified professionals rather than a generic checklist.
A good leaver process also thinks about continuity: who takes over the person’s files, mailbox, approvals and responsibilities. Deleting everything immediately can destroy records the business needs, and data retention schedules may affect what must be kept.
Movers
A mover is someone who changes role, team or location within the organization. This is the case most often missed, for a few reasons.
First, nobody feels responsible. HR records a transfer, the new manager is pleased to have the person, and the old manager has already moved on. Everyone assumes someone else is checking the old access.
Second, the system defaults add rather than replace. A new set of permissions is granted because the new job needs them, and removing the earlier ones feels like extra work with no immediate benefit. Nobody complains about too much access, but they certainly complain about too little.
Third, a mover is rarely flagged as an event. Joiners and leavers produce obvious records. A change of department may only be a field edited in an HR tool.
The consequence is accumulation. Someone who has worked in finance, then sales, then operations may hold access to all three areas. That undermines the least privilege principle and can create conflicts, for example when a person can both raise and approve the same type of payment. Where a business wants those duties kept separate, accumulated access can quietly defeat the intent.
Handling movers better
Several approaches help:
- Treat a change of role as a defined event that triggers a review of existing access, not just the addition of new access.
- Base access on roles, so a move changes the role and the old permissions fall away with it, in whole or in part.
- Ask the previous manager to confirm what should be removed, with a short deadline.
- Allow a short, explicit overlap during handover and set an end date for it, rather than letting it become permanent.
- Use periodic access reviews as a safety net to catch what the process missed.
The role of HR, managers and IT
This process crosses teams, so ownership needs to be spelled out. HR typically holds the authoritative record of who is employed and in which role. Managers know what their people need. IT, or a central identity team, carries out changes. A RACI matrix is a simple way to record who is responsible, who approves and who needs to be informed.
Reliable data is the foundation. If the HR system is out of date, automated processes will act on wrong information. Where possible, access changes should follow the HR record rather than ad hoc requests, though small organizations may do this by hand with a checklist.
Trade-offs
Automation can reduce delays and errors, but it requires setup effort and clean data. Strictly central control gives consistency, yet may slow urgent changes and cannot know every local application. A hybrid is common: central processes cover core systems and a named local owner covers specialist tools.
Strictness also has human costs. Removing access too aggressively from movers can interrupt work, so many organizations choose a short, defined transition. The right balance depends on the sensitivity of the systems and the size of the organization. Security and compliance professionals can advise on what suits yours.