Joiner-Mover-Leaver (JML) is an identity lifecycle model for managing access when a person joins an organization, changes role, or leaves. “Joiner” means provisioning the right accounts and permissions at onboarding. “Mover” means updating access when job duties change. “Leaver” means disabling or removing accounts, tokens, and privileges when the relationship ends. JML is a core part of identity governance and administration because access should follow business need, not remain permanent by default.
In cybersecurity, weak JML processes are a common source of excess privilege, orphaned accounts, and delayed deprovisioning. Attackers often look for stale accounts, shared credentials, or permissions that were never removed after a transfer or departure. Strong JML controls reduce that risk by tying HR or contractor events to automated provisioning, approval workflows, and access reviews. In mature defenses, JML is also used to prove accountability: every entitlement should have an owner, a reason, and a removal path.