identity-lifecycle-administration

# Identity lifecycle administration This is execution: creating, changing and removing access as people arrive, move and leave. **Policy — what a role should be entitled to, and least privilege — belongs to `security:access-and-identity`.** This skill runs the process that policy defines, and the gap between the two is where most access problems live. ## Joiners Provision from the role, not by copying a colleague. Copying is the single largest source of privilege accumulation: it inherits everything that person collected, including access they should not have had, and it propagates that indefinitely. Define role-based bundles for the common cases so a standard joiner is one action, and treat anything outside them as an exception requiring approval. Exceptions are fine; unrecorded exceptions are not. Time provisioning to be complete before the start date — coordinated through `people:onboarding-and-offboarding`. ## Movers are the neglected case Leavers get attention because someone is going. Movers do not, and so access accrues: the person who has worked in three departments has permissions from all three, and nobody ever removed the first two. Treat a role change as a **revoke and re-provision**, not an addition. This is the single highest- value fix available in most organizations, and it is almost always skipped because the person is still present and nothing appears broken. ## Leavers, completely Disable promptly at the agreed time, then work a checklist that rea...