Why User Provisioning Matters for Enterprise AI

Description and use

<p><em>Offboarding a user is not enough when the credentials they leave behind can still spend money and invoke tools.</em></p> <p>An orphaned SSO account is inert. Nobody logs in, nobody clicks anything, and eventually someone notices it during an access review.</p> <p>An orphaned AI credential is different.</p> <p>A <a href="https://dev.to/kenwalger/ai-access-control-for-enterprise-ai-turning-policy-into-runtime-enforcement-5bkk">virtual key</a> can still have a budget, provider and model access, and perhaps permission to invoke MCP tools against other systems. The person it belonged to may

Problem

<p><em>Offboarding a user is not enough when the credentials they leave behind can still spend money and invoke tools.</em></p> <p>An orphaned SSO account is inert. Nobody logs in, nobody clicks anything, and eventually someone notices it during an access review.</p> <p>An orphaned AI credential is different.</p> <p>A <a href="https://dev.to/kenwalger/ai-access-control-for-enterprise-ai-turning-policy-into-runtime-enforcement-5bkk">virtual key</a> can still have a budget, provider and model access, and perhaps permission to invoke MCP tools against other systems. The person it belonged to may

Outcome

<p><em>Offboarding a user is not enough when the credentials they leave behind can still spend money and invoke tools.</em></p> <p>An orphaned SSO account is inert. Nobody logs in, nobody clicks anything, and eventually someone notices it during an access review.</p> <p>An orphaned AI credential is different.</p> <p>A <a href="https://dev.to/kenwalger/ai-access-control-for-enterprise-ai-turning-policy-into-runtime-enforcement-5bkk">virtual key</a> can still have a budget, provider and model access, and perhaps permission to invoke MCP tools against other systems. The person it belonged to may

Evidence

Why User Provisioning Matters for Enterprise AI

Source