A joiner-mover-leaver (JML) workflow is an automated identity process that grants, changes, and removes access as people join an organization, move to a new role, or leave. It typically connects HR systems, identity providers, and applications through provisioning tools, APIs, or standards such as SCIM so accounts, groups, and permissions stay aligned with job status.
JML matters because access drift creates security gaps: stale accounts, excessive privileges, and orphaned credentials are common targets for attackers. If offboarding is slow or role changes are not reflected quickly, a former employee or compromised account may keep access longer than intended. Defenders use JML automation to enforce least privilege, speed revocation, log changes, and support access reviews. In mature environments, JML is a core control for reducing insider risk and limiting the blast radius of account compromise.