Identity and Access Management (IAM) Concepts · Topic 1 of 2
Identity Lifecycle Management
Defining roles, provisioning, reviewing and deprovisioning access, account types, identity proofing and managing AI agents and service accounts.
- 3 min
- Lifecycle: define roles, provision, review, change, deprovision.
- Verify identity before creating accounts.
- Avoid shared accounts; every identity needs an owner.
What it is
Every identity, whether a person, a device, a service or an AI agent, goes through a lifecycle: it is created, given access, reviewed, changed and finally removed. Managing that lifecycle well stops former staff, forgotten accounts and over-privileged identities from becoming a way in.
How it works
Lifecycle stages
| Stage | What happens |
|---|---|
| Role definition | Decide which access each job function needs |
| Identity proofing | Verify a person is who they claim before creating an account, for example checking ID documents |
| Provisioning | Create the account and grant access based on role, approved by the owner of the system or data |
| Review | Regularly check that each identity's access is still needed |
| Change (mover) | When someone changes roles, add new access and remove the old |
| Deprovisioning | Disable or remove accounts promptly when they are no longer needed |
Account types
| Account | Used for |
|---|---|
| Standard user | Everyday work with limited rights |
| Privileged | Administering systems; needs tighter control |
| Service account | Non-human identity used by an application or process |
| Guest | Temporary limited access for visitors |
| Shared | Several people using one login; avoid, because it breaks accountability |
Common lifecycle problems
| Problem | Meaning | Fix |
|---|---|---|
| Privilege creep | Access piles up as someone moves between roles | Remove old access on role change; regular reviews |
| Orphaned accounts | Accounts with no current owner, such as those of former staff | Prompt deprovisioning; account inventory |
| Excessive temporary access | Access granted for a project never removed | Grant with an end date |
Temporary access should be granted with an expiry date that matches the assignment, so nobody has to remember to remove it.
AI agents and service accounts
AI bots and agents act on systems, so they need identities too:
- Give each agent its own dedicated account with a named owner, never a developer's personal login or a shared login.
- The owner of the system the agent will access approves its access request.
- When an agent is handed to another team, transfer ownership and re-approve its access.
- When an agent is retired, disable its account and remove its access.
- Unattended agents authenticate with a certificate or token issued to their own account, not a person's password.
Frameworks and tools
Identity and access management (IAM) systems automate provisioning and deprovisioning, often linked to HR records. Identity governance tools run access reviews. Privileged access management (PAM) tools protect admin accounts. Single sign-on (SSO) and federation let one identity reach many systems.
How the exam asks about this
- "An engineer joins a project for three months." Grant access with an end date.
- "A retired AI bot still has an active service account." Disable it and remove its access.
- "A user kept access from several old roles." Privilege creep.
What to remember for the exam
- Lifecycle: define roles, provision, review, change, deprovision.
- Verify identity before creating accounts.
- Avoid shared accounts; every identity needs an owner.
- Privilege creep is fixed at role change and by reviews.
- AI agents get dedicated, owned, least-privilege accounts that are removed when retired.
Delayed deprovisioning is a common way attackers get in. Disable access promptly when people leave or systems are retired.
Common mistakes
Running automated jobs under a person's login.
Leaving temporary access without an end date.
Reusing or sharing accounts.
Check yourself
What is privilege creep?
The gradual build-up of access beyond what a person or system needs.
Who should approve a new AI agent's access to a system?
The owner of the system it will access.
What should happen to a service account when its application is retired?
It should be disabled and its access removed.
Topic 1 of 2 in Identity and Access Management (IAM) Concepts
Test yourself on Identity and Access Management (IAM) Concepts
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.