Joiners are created seven days before their start date and stay disabled until day one, which absorbs the two-hour provisioning chain from view 10 without a first-day helpdesk queue.
Movers get 24 hours of overlap between old and new access. Instant removal breaks handovers, so people keep old access informally, which is worse.
Leaver revocation is pushed rather than polled: disable, then revoke sessions, so CAE-aware resources drop the session in about a minute.
The fourth lane
Contractors have no termination event in HR, so expiry is a property of the grant. Every contractor package carries a mandatory end date set at approval time.
The sponsor is warned 14 days out and must actively attest; silence expires the access. A sponsor who has themselves left escalates to their manager rather than defaulting to renewal.
This lane is why contractor access does not quietly outlive the engagement — the most common finding in access audits at this scale.
Residual risks
Mover is the weakest of the four. Recalculation is automatic for dynamic groups but package-based entitlements need a review, so accumulated access after several internal moves is the realistic failure.
Licence release on day 7 is a cost decision, not a security one: access ends immediately, the mailbox is held 30 days for legal.
A delayed HR feed delays leaver processing by up to six hours (view 27). Emergency terminations therefore use a manual runbook and do not wait for the feed.
