One lifecycle monitor
Every HR event, and what the platform did about it.
Joiners get their birthright access from policies, movers trigger a review of what they carried along, leavers get revoked and their accounts cleaned up on schedule.
- Birthright via access policies — provenance on every grant
- Mover events spawn a review of carried-over access — immediately, not next quarter
- Leaver enforcement: revoke, disable, then scheduled account finalisation
the lifecycle monitor — what happened, to whom, what was done
