Proving Every Joiner, Mover and Leaver: Citadel Identity360 vs SailPoint

A joiner gets access on day one. A mover picks up new permissions. A leaver's ticket closes. On paper, the lifecycle worked. But when an auditor asks you to prove that the mover's old access is actually gone, that the contractor's accounts stopped working on the engagement end date, and that the service account the leaver owned now has a new owner, a closed ticket is not evidence. That gap is where joiner mover leaver automation usually breaks down.

The real test of JML is proof: every lifecycle event turned into a least-privilege change in the target system, verified, and recorded in a trace you can hand to an auditor. And that proof has to cover more than employees. Contractors, service accounts, and AI agents now change state just as often, and they are the identities most likely to keep access nobody meant them to have.

Citadel Identity360, from Astranova Labs, is built around that standard. It governs employees, contractors, non-human identities, and AI agents in one lifecycle model. It runs a no-code-first admin experience with about 400 hours of included customization, connects to cloud, SaaS, on-premises, and mainframe systems, and closes every joiner, mover, and leaver action only when the resulting access state is verified. This guide uses that standard to compare Citadel with SailPoint.

What verified JML actually means

Identity lifecycle management is not a request workflow. It is a control chain: an authoritative event, identity correlation, policy or role calculation, approval or exception, fulfillment, reconciliation, and a recorded outcome. If any link is missing, the automation is incomplete, however fast the workflow ran.

In practice, verified JML means:

• Joiners get birthright and role-based access from attributes such as position, department, and location, with least-privilege recommendations.
• Movers get new access and lose access that only the old role justified, with SoD conflicts checked before anything is granted.
• Leavers are disabled and stripped of entitlements across connected systems, and their owned non-human identities are reassigned.
• Contractors carry a sponsor and an end date from day one, so expiry is a built-in control rather than something a person has to remember.
• Non-human identities and AI agents follow the same pattern: registration, ownership, scoped authorization, and a fast path to revocation.
• Verification reconciles the target system and closes the action only when the resulting state matches policy.

Citadel Identity360 is designed around that full chain. Its reconciliation and verification step is part of the lifecycle itself, not a separate audit exercise run months later.

Citadel Identity360 vs SailPoint at a glance

Decision area	Citadel Identity360	SailPoint
Lifecycle proof	Every joiner, mover, and leaver action reconciled against the target and closed only on verified state	Lifecycle states and workflows drive changes; verification depends on product, connector, and configuration
Mover access removal	Recalculates access on role or location change and removes access only the old role justified, with SoD checks	IdentityIQ's Manager Transfer event does not change access by default and must be customized
Contractor lifecycle	Native sponsor ownership, engagement end dates, automated expiry, and periodic certification	Handled through lifecycle states and expiry settings that need product-specific configuration
NHI and AI-agent governance	MCP registration, named ownership, tool-level authorization, and a kill switch, with a config file for MCP clients such as Claude, OpenAI, and Cursor	Machine identity coverage depends on separate modules and connectors
Identity graph	Connects people, accounts, entitlements, owners, and approvals to explain every access path	Identity and access data split across products
SoD and risk scoring	SoD checks and risk scoring on joiner and mover changes before access is granted	SoD policies available; configuration varies by product
Connectors	REST, SOAP, SCIM, LDAP, JDBC/SQL, files, SFTP, batch, mainframe, and custom connectivity, plus governed tasks for disconnected apps	Connector catalog; non-connected sources fall back to manual removal tasks
Administration	No-code-first configuration	Significant configuration and customization for JML policy
Implementation	About 400 hours of customization included, plus installation, deployment, and hypercare	No public pricing or included-customization model in reviewed material

Movers are where lifecycle proof is won or lost

Joiners are the easy part of JML. Movers are where privilege creep starts. When someone changes department, location, or manager, the platform has to work out what the new role needs, grant it, and remove whatever only the old role justified. A system that only adds access is not governing the lifecycle. It is letting access pile up.

Citadel Identity360 handles this as a single recalculation. When a role or location change arrives from the authoritative source, Citadel works out the target access, adds what is required, removes what is no longer justified, and runs SoD and risk scoring on the combined result before anything is granted. Each removal goes through the same verification path as a leaver revocation, so the evidence shows the old access is actually gone, not just requested for removal.

SailPoint takes a more configuration-dependent approach. In IdentityIQ, the predefined lifecycle events, including Joiner, Leaver, Manager Transfer, and Reinstate, are disabled by default. Joiner does not provision access until it is customized, and Manager Transfer does not change access by default. Identity Security Cloud uses configurable lifecycle states instead. Either way, mover removal is something a SailPoint team has to build. In Citadel, it is how the lifecycle works out of the box.

Contractors need an end date, a sponsor, and verified removal

Contractor access is where orphaned accounts tend to build up. Engagements end early, get extended informally, or move between projects, and the HR system often doesn't track any of it. Citadel's contractor lifecycle gives every contractor a named internal sponsor, an engagement end date, time-bound access, and periodic certification from the start.

When the end date arrives, Citadel triggers removal unless a valid, approved extension is on record. When a contractor changes projects, Citadel recalculates their access the same way it does for an employee mover. The sponsor stays accountable throughout, so there is always a named person who answers for the access. That is lifecycle governance with a built-in end condition, which is exactly what temporary access needs.

Non-human identities and AI agents belong in the same lifecycle

Service accounts, API keys, workload identities, and now AI agents change state constantly, and they rarely appear in an HR feed. When an employee leaves, the automations they owned don't leave with them. Without governance, those identities become the longest-lived access in the estate.

Citadel Identity360 brings non-human identities into the same JML model:

• Registration: service accounts, workloads, and AI agents are recorded with their purpose and the systems they touch.
• Ownership: every NHI has an accountable human owner, and ownership is reassigned automatically when that owner moves or leaves.
• Tool-level authorization: for AI agents, Citadel's AI governance governs MCP registration and authorizes which tools an agent can call, not just which servers it can reach.
• Kill switch: an agent or NHI can be cut off immediately when it misbehaves or loses its owner.

Citadel's AI governance produces a configuration file that MCP clients such as Claude, OpenAI, and Cursor can use for governed MCP access. That keeps agent access tied to a registered, owned, and authorized identity. It is a governed lifecycle for agents, applied through each client's own MCP configuration.

The identity graph turns lifecycle events into explainable access

Proof needs context. Citadel's identity graph connects people, accounts, entitlements, roles, owners, and approval history, so every access path can be explained: who holds it, through which grant, approved by whom, and justified by which lifecycle state.

That graph is what makes mover recalculation accurate, ties a leaver's owned NHIs to a reassignment task, and lets auditors follow a single trace from the HR event through the policy decision, connector request, target response, and final state. SoD and risk scoring run on top of the same graph. A mover whose new access would create a toxic combination is flagged before the grant, and high-risk changes go to the right approver instead of being auto-fulfilled.

Deprovisioning has to be verified, not just requested

For leavers, the bar is not whether a removal request was submitted. It is whether access was actually removed from the target system, and whether the platform can prove it.

Citadel Identity360 revokes access across connected systems, disables accounts, removes entitlements, reassigns owned NHIs, and reconciles the result. If a target-side action fails, Citadel detects it, retries or assigns an owner, records the failure state, and keeps the action open until revocation is confirmed. Nothing closes on a hope.

SailPoint's behavior depends more on connectivity. When an expiring access item is connected directly to the source, it can deprovision automatically. When it is not, SailPoint creates a manual removal task for the source owner. Its terminated and archived lifecycle states remove all access by default, but there are exclusions, and deleted accounts cannot be restored. So the deprovisioning outcome in SailPoint depends on connector reach and configuration, and that is exactly where gaps in proof appear.

Broad connectors keep proof consistent across a hybrid estate

Verified JML only works if the platform reaches the systems where access actually lives. Citadel connects to Workday, SAP, Microsoft 365, ServiceNow, Salesforce, AWS, Azure, Google Cloud, Active Directory, Entra ID, and SCIM-compatible applications. Its connector framework supports REST, SOAP, SCIM, LDAP, JDBC/SQL, XML/JSON, flat files, SFTP, scheduled batch feeds, mainframe, and custom connectivity.

For disconnected or batch-only systems, Citadel still applies the full control chain. Approvals, fulfillment tasks, tracking, and evidence all run through the same lifecycle, so a mainframe revocation produces the same audit-ready record as a SaaS one. Any custom connector work fits inside the included customization hours.

No-code-first configuration and 400 included hours lower the cost of proof

JML programs rarely fail because the concept is wrong. They fail because the implementation gets too expensive to adapt as roles, sources, and applications change. Citadel is no-code-first: lifecycle policies, approval paths, contractor rules, and mover logic are configured, not coded. Estate-specific work, such as source mapping, file layouts, or a custom connector for an in-house system, is covered by about 400 hours of included customization, along with installation, deployment, and hypercare.

Astranova positions that model at roughly 50% lower cost than a comparable deployment. With SailPoint, JML behavior beyond the defaults usually needs workflow customization, and the reviewed material publishes no included-customization model. For a CIO, that is the difference between a fixed, scoped program and an open-ended services engagement.

How to prove it in a pilot

Run a Citadel Identity360 pilot that tests outcomes, not screens:

1. Joiner: one employee and one contractor from the authoritative source, with sponsor and end date captured for the contractor.
2. Mover: one role change that both adds and removes access, with an SoD check on the result.
3. Leaver: one termination across a SaaS app, an on-premises directory, and a batch or legacy target.
4. NHI: one service account or AI agent owned by the leaver, reassigned automatically, with MCP tool-level authorization and the kill switch exercised.
5. Failure: one forced target-side failure, detected, retried, and closed only on verified revocation.

Then open the audit trail and follow a single trace from event to verified state. Book a Citadel Identity360 demonstration and run these five scenarios against your own estate.

Bottom line for CIOs and Heads of IT

Citadel Identity360 is the stronger choice for joiner mover leaver automation that has to stand up to audit. It governs employees, contractors, NHIs, and AI agents in one lifecycle, removes mover access as part of the same recalculation that grants new access, verifies every revocation, and explains every access path through the identity graph. It also delivers all of this no-code-first, across a broad connector estate, with about 400 hours of customization included.

SailPoint offers lifecycle states and configurable workflows, but its key mover and leaver behavior depends on customization, product choice, and connector reach. When the standard is verified state change for every identity type, Citadel gives you that proof by design.

FAQ

Which platform better supports employee and contractor JML?

Citadel Identity360. It runs employees and contractors in one lifecycle model, with sponsor ownership, engagement end dates, automated expiry, mover recalculation that removes outdated access, and verified revocation across hybrid systems.

How does Citadel prove that offboarding actually happened?

Citadel reconciles each target system after revocation and closes the action only when the resulting state matches policy. Failures are detected, retried or assigned, and recorded, so the audit trail shows the verified outcome rather than just the request.

Does Citadel govern service accounts and AI agents in the JML lifecycle?

Yes. Citadel registers NHIs and AI agents, assigns accountable owners, reassigns ownership when those owners move or leave, enforces MCP tool-level authorization, and offers a kill switch. Its AI governance produces a configuration file that MCP clients such as Claude, OpenAI, and Cursor use for governed MCP access.

Can access changes require approvals?

Yes. Citadel routes routine birthright access automatically and sends sensitive or high-risk changes, flagged by SoD and risk scoring, through configurable approval paths. Every decision and approver is recorded in the same trace as the fulfillment.

What should an audit-ready JML record show?

The identity event, the policy decision and approver, the connector request, the target-system response, the verified resulting access state, and any exception or remediation. Citadel links all of these in one trace through the identity graph.

How much customization does JML automation need with Citadel?

Most joiner, mover, leaver, and contractor flows are configured no-code-first. Estate-specific work, such as custom connectors, file layouts, or mainframe feeds, fits inside the roughly 400 hours of customization included with Citadel.