Joiner–Mover–Leaver Should Cover GitHub, Vault, and Cloud

Joiner–mover–leaver (JML) via SCIM works well for email, chat, and HR apps. It often stops at the engineering fence: GitHub orgs, CI, Vault, AWS IAM Identity Center, Kubernetes.

New hires wait on tickets. Movers keep old repo admin. Leavers lose SSO but keep a personal access token that still clones the monorepo.

A group in the directory is not the same as “maintainer on these five repos and deploy role in staging.” AuthOne can turn directory events into updates on those systems in near real time — not the next night’s batch sync.

When someone moves from backend to platform security, drop the old cloud roles the same day you add the new ones.

Raw “add user to team” API calls drift and are hard to audit. Map JML events to pull requests against an access-as-code repo. CI can block toxic combinations before merge.

Git becomes the history of who got what, with the same review culture you already use for infrastructure.

Disable the IdP account and you have not finished. Kill SSO sessions, rotate bot secrets they owned, revoke PATs, expire cloud consoles.

Stream proof of those revokes to your SIEM. If you cannot show that engineering access died with the HR event, you do not have a leaver process — you have a hope.