Has an owner and a deadline
A new hire who cannot work on day one produces an immediate, visible complaint. That is why provisioning gets automated first — and often why it is the only part that ever does.
Usually automatedJoiner / Mover / Leaver
The mover is the one that gets you
Joining is automated first, because somebody complains when it is slow. Leaving is audited, because somebody asks. Moving is neither — and it is how a person ends a fifteen-year career holding the permissions of every job they ever had.
Three events, three very different levels of attention
Almost every organisation automates the first. Very few finish the sentence.
Has neither
A transfer adds what the new role needs. Almost nothing removes what the old one had, because nobody owns that removal and nothing breaks when it is skipped.
Usually manual, usually partialHas attention, and still slips
The termination is known, but it has to reach every connected system — including the ones provisioned by hand and the ones nobody remembers.
Automated in partFifteen years, one person
Nothing here is a failure. That is the problem.
Every step was approved by somebody with the authority to approve it. Nobody made a mistake. The result is still a finance lead who can raise a support ticket as any customer and read the sales pipeline.
What it takes to close the loop
The pieces, in the order they have to exist.
An authoritative source
HR for employees, a contract system for externals — something that says a person exists, what they do, and when they stop. Without it every downstream rule is a guess.
Connectors both ways
Reading the source and writing to the targets. A lifecycle that can grant access but not remove it has automated only the easy half.
Birthright access from roles
What a role gets by virtue of being that role, defined once, so joining and moving become the same operation with different inputs.
Requests and approvals for the rest
Not everything derives from a role. What is requested needs a workflow, an approver who understands the request, and a record of the decision.
Removal as a first-class step
The mover flow has to take away as deliberately as it grants. If removal is optional in the design, it will be skipped in practice — see the chart above.
Certification that is not theatre
Review targeted at what actually changed, so reviewers read something short enough to think about rather than approving a hundred lines at once.
How Monokee approaches it
One flow per event, drawn where everyone can read it
The event drives the flow
A hire, a transfer, a contract end or a long absence each trigger a flow with explicit branches: the department that needs approval, the role that carries a conflict, the system handled by hand.
Governance and orchestration together
Roles, entitlements and associations live in the governance layer; the workflows that change them are built on the same canvas as the rest of identity. No second automation tool to keep aligned.
Exceptions stay visible
Systems that cannot be provisioned automatically become an explicit manual step with an owner and a record — instead of an omission that surfaces at the next audit.
Bring us somebody who has been here fifteen years
Their access is the most honest description of your lifecycle processes that exists. We'll walk through it with you.
Talk to an expert