The joiner-mover-leaver (JML) lifecycle is the standard identity process for onboarding a person, changing their role, and removing their access when they leave. “Joiner” covers account creation and initial permissions, “mover” covers transfers or responsibility changes, and “leaver” covers offboarding, disablement, and revocation of access.
In cyber security, JML matters because access should track a person’s current job, not their history. Weak JML handling leads to stale privileges, orphaned accounts, and excessive permissions that attackers can abuse after credential theft or a compromised insider account. In modern environments, the same discipline also helps with delegated or agentic access: security teams must know who owns the identity, what it can do, and when its privileges expire. Good defenses include automated provisioning and deprovisioning, least privilege, approval workflows for role changes, and regular access reviews to remove permissions that no longer match the user’s task.