A promotion or a team transfer is the quietest way to keep last quarter’s production access. The IdP group for the old role is still there. The SaaS admin seat is still there. The quarterly campaign is months away. Rutagon builds access review after role change as a mover job: the HRIS transfer or promotion event opens a scoped recertification, and the prior role is revoked in the same week unless a named exception says otherwise.
Mid-market SaaS companies often treat movers like joiners with extra groups. That is how privilege stacks. The person who left support for engineering still resets customer passwords. The new manager still has the individual-contributor deploy role. We do not wait for the next all-hands review to notice.
This is scoped work. We recertify what the new role needs and we remove what the old role used. We do not relaunch the entire company campaign because one person changed teams.
Access Review After Role Change, Same Week
Access review after role change starts when HR marks a transfer, promotion, or legal-entity move. We resolve the old job profile and the new one to entitlement bundles you already maintain for joiners. The delta is the review: keep, add, revoke. Reviewers are the new manager plus an app owner for any privileged leftover from the old bundle.
Same week is a clock, not a slogan. The event timestamp starts a window. If the new manager does not complete the scoped recert, the old bundle still revokes on the deadline and the new bundle waits on explicit grants. That ordering prevents “approve later” from meaning “keep everything.” People who need a day of overlap get a dated exception, not an open-ended stack.
The job sits next to joiner-mover-leaver automation. Joiner minting and leaver revoke are siblings. Mover is the one most teams skip because the person is still employed.
What Gets Recertified and What Gets Cut
Scoped recertification is not a full user-access review of every SaaS tenant. It is the bundles and the standing exceptions attached to the old role. We pull effective access, mark each grant as old-bundle, new-bundle, or neither. Neither is the dangerous pile: personal groups, one-off tickets, and “temporary” production roles from the last incident.
Old-bundle grants revoke unless the new bundle includes them or an exception is filed. New-bundle grants that the person lacks are requested through the normal joiner path so we do not invent a second provisioner. Neither-grants require an owner decision in the same window.
Custom apps follow the same delta. If the old team’s internal tool has no SCIM, we still have an export and a revoke action, the same as custom application access reviews. A transfer that only updates the HR title is not done.
Evidence for the Mover Sample
Auditors who pick a promoted person should see the HR event, the two bundles, the recert decisions, and the revoke times. They should not see a title change and an unchanged group list. We store the packet with a stable mover ID and we attach it the same way we attach leaver packets.
If a grant could not be revoked because the vendor API failed, the packet stays open. A green campaign with a failed mutate is a lie. Retry is automatic; a human owns the residue.
mover_id: xfer-884
hr_event: promotion
from_bundle: support-l2
to_bundle: eng-backend
revoke:
- system: zendesk
grant: admin
at: same-week-deadline
keep:
- system: idp
grant: everyone
exception:
- system: prod-deploy
until: dated
owner: new-manager
Automated access reviews still run on the quarterly cadence for people who did not move. This job is the intra-quarter control. Security automation is the build surface.
AWS and the Prior Role
IAM groups and permission sets stack the same way SaaS roles do. A transfer that updates an IdP group but leaves an IAM permission set attached is an incomplete mover. We include AWS assignments in the delta when the old role had them. Last-accessed data from IAM access advisor can show that the old permission set is still being used after the title change. Use is not permission to keep it. The new bundle decides.
We do not print a dollar cost for leftover IAM. The cost is blast radius. Standing admin after a promotion is the finding.
Group ownership, shared inboxes, and the week of overlap
A role change that only updates the worker’s groups still leaves wreckage in objects they owned. Shared inboxes, SaaS workspaces, on-call rotations, and IdP group ownership often stay on the old person until something breaks. We include an ownership sweep in the same-week mover job: objects whose owner is the mover get a living successor from the old manager or the new one. Unowned objects after the deadline are findings, not leftovers for the next quarterly review.
Overlap is the usual negotiation. Sales-to-sales-manager still needs the old book for a few days. We allow a dated read or a dated role, listed on the exception, with a revoke job already scheduled. What we do not allow is copying the entire old bundle into the new bundle “to be safe.” That copy is privilege creep with a promotion announcement.
If HR posts the transfer late—the person already sat with the new team for two weeks—the clock still starts at the event we received, and we also back-scan grants created after the real start date you confirm. Late HR is common. The engineering response is a wider delta, not a shrug. Grants minted in the gap are the neither-pile.
Contractors who convert to employees are movers, not joiners. Their contractor sponsor row must close. Their employee bundle must open. A conversion that only changes the HR worker type and leaves the vendor-guest account alive is an orphan in waiting. We treat that as a role change with a harder revoke on the guest side.
Managers who inherit a team without an HR event still need a trigger. We accept a ticketed bundle change from GRC or HR ops when the org chart moved and the HRIS did not. The packet looks the same. The source field says “manual bundle change” instead of “HR transfer.” Auditors can sample either.
The AWS permission set attached to the old job is part of the ownership sweep when that set is assigned to the user. Removing the IdP group and leaving the permission set is the incomplete cut we already named. The sweep lists it. The deadline still applies.
Frequently Asked Questions
Does a title change without a team change fire this review?
Only if your HR event says the job profile or entitlement bundle changed. A cosmetic title that maps to the same bundle should not revoke access. We key off the bundle ID you maintain, not the display name on the org chart.
What if the new manager is on leave during the same week?
Then the backup reviewer on the bundle owns the recert. The revoke deadline does not slide because one person is out. If you need a longer overlap, file a dated exception with a second owner. Open-ended “until they return” is how old roles survive.
Can the person keep old access until they finish a handoff?
Yes, as a dated exception with a named owner and a system list. The exception expires into a revoke. A handoff that needs read-only for a week should say read-only, not keep admin.
Is this the same as a quarterly access review?
No. Quarterly review covers the remaining population. This review covers the delta from a role change. Skipping the mover job and hoping the quarter catches it leaves months of stacked privilege in the observation window.
See what an Access & Credential Governance Diagnostic finds in your environment. Call 907-841-8407, email contact@rutagon.com, or use rutagon.com/contact.