Ensure that when an employee's role changes — promotion, lateral transfer, department move — their access changes to match the new role, and access tied to the old role is removed. This is the stage most often done incompletely: access gets added for the new role, but old access is never revoked.
A "mover" event is where privilege creep originates. An employee who has moved through three roles over five years, each time gaining new access and never losing the old, ends up with a cumulative entitlement set no single role would ever justify — and that's exactly the kind of access an attacker (or a curious insider) benefits from.
| Step | Owner | Action |
|---|---|---|
| 1 | HR | Role change recorded in HRIS (new title, department, manager) |
| 2 | HRIS → IAM | Automated trigger flags the identity for access recertification |
| 3 | New Manager | Confirms access needed for the new role (via role template) |
| 4 | IAM | Provisions new-role baseline access |
| 5 | Old Manager / System Owners | Explicitly confirm removal of access tied to the old role |
| 6 | IAM | Deprovisions access no longer required |
| 7 | Audit trail | Both the "added" and "removed" actions logged with approver identity and timestamp |
Rather than treating a mover as "add new access," treat it as a delta:
Old Role Entitlements → New Role Entitlements
= Access to ADD (in new, not in old)
+ Access to REMOVE (in old, not in new)
+ Access to RETAIN (in both — still review for necessity)
This framing forces an explicit removal step instead of leaving it implicit (and therefore, in practice, often skipped).
A Loan Officer promoted to Branch Manager at Meridian:
- Gains: approval authority in the loan origination system, access to branch performance dashboards
- Loses: individual loan-origination entitlements now handled by their team (retaining these would create an SoD conflict — a manager approving their own originated loans)
- Retains: core banking read access, email, HRIS self-service
flowchart TD
A[Role change recorded in HRIS] --> B[Access recertification triggered]
B --> C[New role: baseline access provisioned]
B --> D[Old role: access flagged for removal]
D --> E{Manager/System Owner<br/>confirms removal}
E -->|Confirmed| F[Access deprovisioned]
E -->|Disputed| G[Escalate to IAM/Security for review]
Next: Leaver — Offboarding →