Joiners, movers and leavers: the access problem hiding in plain sight

Ask most organizations who has access to what, and the honest answer is "we're not entirely sure." Access tends to accumulate. Someone joins and gets set up in a hurry. They change roles and gain new permissions without losing the old ones. They leave, and their accounts linger because disabling them was nobody's specific job. Do that for a few years and you have a quiet pile of open doors.

This is usually treated as an IT task, but it is really a coordination problem — which is why it so often falls between departments.

The joiner

A good first day is not luck; it is a checklist that ran. Accounts created, the right access granted and no more, a device ready, and someone to walk them through it. When that process is missing, new hires spend their first days chasing access — and, worse, someone grants broad permissions "to save time" that never get narrowed later.

The mover

Role changes are where access quietly bloats. The person who moved from finance to operations often keeps their finance access indefinitely, because removing it requires someone to notice and act. Over time, long-tenured staff accumulate permissions far beyond what their current job needs — the exact opposite of least privilege.

The leaver

This is the one that shows up in incident reports. An account that was never disabled, a shared password never changed, a vendor login from a project that ended two years ago. Every one is a way in that belongs to no one and is watched by no one.

Making it routine

None of this requires special software. It requires an owner and a repeatable process: a short checklist for each of the three events, tied to the moment HR already knows about them, with a periodic review to catch what slipped through. The technology to disable an account takes thirty seconds. The discipline to make sure someone always does is the actual work.

Access you granted and forgot is still access. The organizations that handle joiners, movers and leavers well are rarely the ones with the fanciest tools — they are the ones who made it somebody's job.