> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/reference/identity-lifecycle-joiner-mover-leaver.md).

# Identity lifecycle: joiner, mover, leaver

Most access problems are lifecycle problems. Someone joins and gets access by hand. Someone changes role and keeps what they had. Someone leaves and their account stays open. None of that shows as an error — the system is doing exactly what it was told.

Lifecycle automation is the answer: SECUREpass reacts to changes in the HR system or directory, applies provisioning rules, and triggers approvals and certifications where they are needed.

## Joiner

When a new identity appears in the source system, SECUREpass provisions the account and grants **birthright access** — the access that comes automatically with a department or a role, and that nobody should have to request.

Getting birthright right is what makes day one work. A new joiner who can sign in and reach their core applications without a ticket is the difference between onboarding that works and onboarding that generates a queue.

## Mover

When someone's role or department changes, SECUREpass adjusts their access to match, and can trigger a re-certification of the new access.

This is the case organisations most often get wrong. Adding the new access is easy and everyone remembers to do it; removing the old is the part that gets skipped, and it is how people end up holding the accumulated access of every role they have ever had. A mover is a leaver from one role as much as a joiner to another.

## Leaver

On termination, access is revoked immediately and the account is disabled and archived.

Immediately is the operative word. The window between someone leaving and their access being removed is the window in which the account is both live and unowned.

Archiving rather than deleting keeps the audit trail intact — you need to be able to answer what that account did, long after the person has gone.

## Access that is not birthright

Anything beyond birthright follows the request path: the user asks, an approver decides, and the access is provisioned automatically on approval. That keeps the exceptional access exceptional, and recorded.

## Self-registration

External users — partners, vendors, customers — can register themselves, with an approval workflow standing between the registration and any access being granted.