Lifecycle Governance Is Never Complete

Lifecycle is often the first place the operating model shows whether it is working.

If lifecycle signals are incomplete or inconsistent, the rest of the model cannot function.

Most organizations have gaps. Some applications sit outside IGA and rely on tickets or email. Some identity types, contractors, service accounts, external users, fall outside governed lifecycle entirely. Some lifecycle events, like transfers or leaves, never trigger access changes because HR and IAM systems don't produce reliable signals. In some environments, provisioning has been automated into applications never connected to deprovisioning. Access goes in. It does not come out.

Lifecycle can look governed from the center while the edges operate independently.

Risk accumulates at the edges.

This is where risk and change appetite from Post 7 become practical. The gaps will not all close at once. Which gaps close first, and how aggressively, depends on actual appetite. Starting with a limited set of functions and applications may be the right approach while the gap picture is being worked.

The current state inventory makes this analysis possible. Without it, gaps remain invisible.

Start by getting clear on:

• • Which applications are outside IGA coverage
• • Which identity types have no governed lifecycle
• • Where provisioning or deprovisioning is still manual
• • Which lifecycle events trigger access changes and which do not

Measure:

• IGA application coverage rate
• Identity type lifecycle coverage
• Manual provisioning and deprovisioning volume
• Orphaned account rate
• Time to deprovision on offboarding

The goal is not to close every gap at once. The goal is to know where they are and close them deliberately.

❓Where is lifecycle governance working in your environment, and where is it only assumed?