Joiner-Mover-Leaver, actually automated

Most JML pipelines do joiner and leaver well — those are the events people see. The mover is where access debt accumulates: a transfer happens, the old groups are never removed, and three years later the user has access to four departments they don’t work in.

The pattern I rely on is a queue of declarative entitlement states. Each HR event publishes the desired end-state for the user. The automation diffs the current state against the desired state and emits the minimum set of Graph API calls to converge.

Two properties fall out of this design: every change is auditable as a diff, and replaying the queue from any point reproduces the user’s access. That is the bar for ‘actually automated’.