Joiners
A joiner is a new hire. HR creates the record, and IAM provisions the accounts and access that the role needs, based on an access matrix or role definition, not on what a coworker happens to have.
Common mistakes: copying a coworker's access, provisioning before the HR record is final, and granting access that needs separate approval without recording it.
Movers
A mover changes job, department or manager. The new access is added and, just as important, the old access is removed. Movers who keep old access build up toxic combinations that break separation of duties.
Common mistakes: adding the new access but leaving the old, and changing groups without updating job data that downstream systems depend on.
Leavers
A leaver's accounts are disabled on time, sessions are revoked, and access is removed. Termination timeliness is one of the controls auditors test most often.
Common mistakes: disabling the account but leaving active sessions, missing accounts outside the main directory, and leaving contractor accounts with no expiry date. Enabled accounts that should have been disabled are a common entry point for password spraying.
Practise JML on a realistic queue
In Rolevara you work joiner, mover, leaver, rehire and leave-of-absence tickets against a fictional company's access matrix. Each ticket is graded on the account state afterwards and on the process: verification, approval and order of steps. Miss a step and the requester replies, or the gap returns later as a security incident.
Practise it on a realistic job
Work joiner, mover and leaver tickets and see how each one is graded.
Try JML ticketsQuestions
What does JML stand for in IAM?
Joiner, mover, leaver: the three lifecycle events that drive account creation, access changes and account removal.
Who owns the joiner, mover, leaver process?
HR owns the trigger (the employment change), managers approve the access, and the IAM team carries out and records the changes.
What do auditors test in the JML process?
Usually that new access was approved before it was granted, that leavers were disabled within the policy time limit, and that the evidence supports both.