A new employee is waiting for access. A transferred employee still holds old permissions. A departing contractor has accounts that someone must remember to disable.
These everyday situations reveal how well an identity-governance program supports the business.
Effective joiner-mover-leaver automation should help people become productive, keep permissions aligned with changing responsibilities and coordinate access removal when an engagement ends.
Citadel Identity360 brings these activities into a common governance model, combining lifecycle automation, integrated contractor management, hybrid connectivity and configurable administration.
For enterprises comparing Citadel Identity360 and SailPoint, Citadel offers a compelling combination: adaptable lifecycle workflows, governance across modern and legacy applications, and 400 included customization hours to address business-specific requirements.
Joiners: Make onboarding a coordinated process
A successful onboarding process gives a new employee the access their role requires, with the appropriate approvals and controls.
That process can involve an HR source, a directory, collaboration tools, business applications and systems maintained by separate application teams. Without coordination, managers and service-desk staff become responsible for chasing each step.
Citadel automates joiner workflows and provisioning orchestration, helping organizations turn identity information and access policies into coordinated onboarding activities.
Role-based and context-aware access supports standard assignments, while access-request and approval workflows handle additional requirements.
The practical benefit is consistency. Teams can establish repeatable onboarding processes while accommodating differences between departments, locations and applications.
KuppingerCole’s guide to identity governance and administration explains the broader relationship between lifecycle processes, access governance and provisioning.
For a Citadel demonstration, bring the onboarding process that currently generates the most follow-up tickets. It provides a concrete starting point for exploring where automation and configuration can reduce coordination work.
Movers: Address the access employees should leave behind
Employee transfers are often the most revealing test of lifecycle automation.
New permissions attract attention because the employee needs them to perform a new role. Old permissions can remain unnoticed because removing them does not unblock an immediate business request.
Over time, this creates privilege accumulation.
Citadel connects role changes with lifecycle governance, access reviews and identity-risk controls. This supports a mover process that considers access to retain, access to grant and access to remove.
Consider an employee moving from procurement to finance. The change may require finance-system access while making supplier-management permissions unnecessary. Keeping both could also introduce a segregation-of-duties conflict.
The governance workflow should address the complete change:
- Evaluate the employee’s new responsibilities.
- Identify the access required for the new role.
- Review permissions inherited from the previous role.
- Apply approval and policy requirements.
- Coordinate provisioning and deprovisioning.
- Track the resulting actions and unresolved exceptions.
This is how mover automation supports least privilege and the reduction of shadow access.
Citadel’s appeal is particularly strong for organizations whose transfer processes currently add access more reliably than they remove it.
Leavers: Track offboarding through to completion
Offboarding spans the applications in which a person holds access—not just the directory account everyone remembers.
A departing employee may retain permissions in SaaS tools, cloud platforms, databases and older applications with local accounts. Some systems support direct automation; others require application-owner action.
Citadel coordinates lifecycle access changes across connected and disconnected applications, bringing different fulfillment paths into a governed process.
Where the target supports it, deactivation or revocation can be automated. Where a system depends on batch processing or manual administration, the process can include assigned tasks, progress tracking and completion evidence. Explore Citadel’s hybrid and legacy integration approach.
An important distinction remains visible throughout: a request to remove access is different from confirmation that access has been removed.
This focus on outcomes aligns with the wider purpose of identity and access management: appropriate access to resources throughout the lifecycle.
For IT and security teams, Citadel provides a practical foundation for making offboarding accountable across systems that behave differently.
Contractors: Put engagement dates at the center of access governance
Contractors and external workers often sit outside the employee HR lifecycle.
Their access may depend on an internal sponsor, a project, an engagement end date and subsequent extensions. Treating them as ordinary employees can leave important lifecycle events unmanaged.
Citadel integrates contractor management into its wider identity-governance model, covering sponsorship, start and end dates, extensions, validation, expiry and deprovisioning.
This makes contractor access a managed lifecycle rather than a recurring reminder exercise.
For example, an approved engagement extension should update the relevant lifecycle information. An engagement that ends should initiate the corresponding access-removal process.
Gartner’s discussion of evolving IAM and contractor access provides an additional industry perspective on this area.
For enterprises with significant contractor populations, Citadel’s integrated approach is a strong reason to explore the platform.
Adapt lifecycle workflows as the business changes
JML processes rarely remain unchanged after implementation.
A new location needs a different approval chain. An acquisition introduces unfamiliar applications. A department changes its access policy. A contractor program adds another validation requirement.
Citadel’s no-code-first administration is designed to let IAM administrators manage routine workflows, policies, approvals, notifications and reporting configuration with less dependence on product-specific development.
Citadel also includes 400 hours of customization for requirements such as business-specific workflows, integrations, application provisioning and reports. Learn about Citadel’s administration and customization approach.
For buyers, this creates a concrete implementation advantage: adaptation capacity is part of the proposition.
Bring the exception that currently sits outside your standard process—the unusual approval, proprietary application or regional workflow. Explore where configuration applies and where included customization can address the remaining requirement.
Preserve governance throughout the lifecycle
Automation needs to operate within access controls.
Citadel brings access requests, approvals, segregation-of-duties controls, risk-aware reviews and access certifications into the same platform as lifecycle management.
This helps teams connect an access change with the governance decisions surrounding it.
Citadel’s broader scope also includes service accounts and machine identities. These matter during workforce changes because a departing employee may own identities that continue supporting essential business processes.
Such cases require an ownership and dependency decision. Removing the employee’s access and deciding what happens to an operational service account are separate responsibilities.
A broader identity lifecycle perspective helps keep both in view.
Why choose Citadel as your SailPoint alternative?
SailPoint provides established lifecycle automation through configurable lifecycle states and provisioning actions. Its Identity Security Cloud supports access changes based on identity status. See SailPoint’s lifecycle-state documentation.
Citadel’s strongest case is the combination it brings to implementation and everyday operation:
| JML priority | Why explore Citadel |
|---|---|
| Consistent employee onboarding | Lifecycle workflows, access policies and provisioning orchestration |
| Controlled role changes | Coordinated access additions, removals, reviews and risk checks |
| Accountable offboarding | Automated and task-based fulfillment across application types |
| Time-bound external access | Integrated contractor sponsorship, engagement dates and expiry |
| Business-specific processes | Configurable workflows and included customization capacity |
| Ongoing administrative ownership | No-code-first administration for routine changes |
For a new or modernized identity program, these capabilities give Citadel a strong position on the shortlist.
The buying decision should consider what happens after go-live: how your team will onboard the next application, change an approval process, handle an exception and establish that offboarding is complete.
Citadel’s combination of lifecycle breadth and administrative flexibility makes it particularly compelling for organizations seeking greater control over that ongoing work.
Bring your most difficult lifecycle event to Citadel
Choose a scenario that regularly creates manual effort or access risk.
A new hire who needs several business applications. A transfer that leaves old permissions behind. A contractor whose engagement is repeatedly extended. A departure involving a legacy system.
Use that scenario to explore Citadel’s policies, approvals, fulfillment paths and evidence. Then see how your own administrators would maintain the workflow as requirements change.
Book a Citadel Identity360 demonstration around your joiner-mover-leaver process. Discover how configurable automation, integrated contractor governance and included customization can help your team build a more consistent identity lifecycle.
Frequently asked questions
What is joiner-mover-leaver automation?
JML automation coordinates access when someone joins an organization, changes responsibilities or leaves. It includes the policies, approvals, provisioning, access removal and evidence associated with those events.
Why is mover automation particularly important?
Employees can accumulate unnecessary permissions when new access is added without reviewing old access. A governed mover process addresses both the new role’s requirements and permissions that should be removed.
Can Citadel manage contractor expiry?
Citadel’s contractor lifecycle capabilities include engagement dates, extensions, validation, expiry and deprovisioning within its broader governance model.
Can Citadel include legacy applications in JML workflows?
Yes. Citadel supports a range of integration patterns and can coordinate automated fulfillment alongside batch-based or accountable manual tasks.
What makes Citadel worth exploring alongside SailPoint?
Citadel combines employee and contractor lifecycle governance, hybrid integration, no-code-first administration and 400 included customization hours. This makes it a compelling option for enterprises seeking adaptable JML automation and greater ownership of day-to-day administration.