Identity lifecycle administration

This is execution: creating, changing and removing access as people arrive, move and leave. Policy — what a role should be entitled to, and least privilege — belongs to security:access-and-identity. This skill runs the process that policy defines, and the gap between the two is where most access problems live.

Joiners

Provision from the role, not by copying a colleague. Copying is the single largest source of privilege accumulation: it inherits everything that person collected, including access they should not have had, and it propagates that indefinitely.

Define role-based bundles for the common cases so a standard joiner is one action, and treat anything outside them as an exception requiring approval. Exceptions are fine; unrecorded exceptions are not.

Time provisioning to be complete before the start date — coordinated through people:onboarding-and-offboarding.