Joiners, movers, leavers

Every account has a life: it’s created, it changes as the person’s role changes, and one day it’s switched off. “Joiners, movers, leavers” (JML) is the shorthand for that lifecycle, and knowing which step you’re in tells you what should happen to the account.

Grant, adjust, revoke

Every account has a lifecycle. The leaver step is the security-critical one: disable, don't dawdle.

• Joiner: a new person needs an account and the access to do their job. The work here is provisioning: create the identity and grant the right groups and apps.
• Mover: someone changes role. Add what the new role needs and remove what the old one no longer does. This is least privilege in action.
• Leaver: someone’s leaving. Their access should be revoked promptly so nothing lingers after they’re gone.

Least privilege, in plain terms

Access that outlives its reason is quiet risk. The mover step is where that risk creeps in: it’s tempting to add the new access and leave the old “just in case.” Don’t: an account should carry only what its current role needs.

The leaver step is the sharp one

Disable promptly, and usually don't delete

An account still active for someone who has left is an open door. The leaver step is the security-critical one: disable the account quickly to close off access. Deleting outright can destroy data or break audit trails, so the standard move is to disable, not erase.

Your L1 part is often to recognise which case you’re handling and follow the checklist, routing provisioning or de-provisioning to the right team where your process requires it.