When a security leader joins a new organisation, the first weeks are usually spent learning the business, meeting stakeholders and mapping priorities. What rarely gets attention in that window is the quiet accumulation of access they inherit from the person who held the role before, and the legacy entitlements that follow them from their previous employer. Identity governance is supposed to answer the simple question of who has access to what and why, yet the moment a senior hire arrives with a fresh start date and a historic trail of permissions, that answer becomes considerably harder to give.
The problem is structural rather than accidental. Most organisations still treat joiner, mover and leaver processes as discrete administrative events handled by an IT service desk, rather than as continuous state transitions across an identity estate. A new starter ticket gets raised, a set of baseline entitlements gets assigned, and the work is considered finished. Nobody systematically asks whether the person already holds access through a service account created during a contractor engagement, a shared mailbox, a legacy local account attached to an old project, or a federated application whose provisioning is owned by a business unit rather than the identity team. Each channel is legitimate in isolation. Together they mean a new joiner can arrive with a permission profile that no single system fully describes.
The same gap runs in reverse at offboarding. Automated deprovisioning typically covers accounts under central management. It does not necessarily cover the API keys requested for a data pipeline, the service principal created for a proof of concept, the vendor portal login tied to a corporate address, or the privileged credential stored in a personal password manager. Every one of those is an identity lifecycle artefact, and every one survives the ticket that was marked resolved.
Why the first 90 days matter most. Access accumulates fastest during organisational change. A new executive typically triggers a cascade of downstream effects: direct reports are reshuffled, delegations are issued, approval authorities are reassigned and temporary project access is granted to smooth the transition. IGA programmes running quarterly access reviews will not see any of this until the next certification cycle, by which point the drift is baked into the environment. Shortening the interval between a change event and a governance check is more valuable than making the check itself more thorough.
Treat inherited access as an explicit risk category. Rather than assuming a new joiner starts from a clean baseline, governance teams should be able to produce an inherited access report as part of the onboarding workflow. That means reconciling directory accounts against application entitlements, cloud IAM roles against group memberships, and service accounts against the humans who own them. Where ownership is ambiguous, the correct default is to treat the account as orphaned and require re-attestation rather than assume it is still needed. An internal promotion should trigger an entitlement diff, not just a title change.
Make ownership a first-class attribute. Stale access persists because nobody is accountable for it. Programmes that succeed make ownership explicit at the point of creation, not the point of review. Every account, group, role and service credential should have a named business owner, visible in the same place a reviewer looks when certifying access. When ownership is missing, the finding should be treated as a control failure rather than a data quality issue.
Measure the residual, not the process. Metrics such as the number of access reviews completed describe activity, not exposure. A more honest measure is the count of entitlements held by identities with no confirmed business owner, tracked over time. That number tells a CISO how much of the estate is effectively ungoverned, and it belongs in governance reporting alongside the standard certification completion figures.
Identity governance works best when understood as the discipline of maintaining an accurate, defensible answer to who has access to what. New hires and role changes are not edge cases in that discipline. They are the moments when the answer is most likely to be wrong.