license agent's deprovision dry-run flagged the IT admin's own account

TL;DR

Exclude break-glass and admin accounts from reclamation candidacy permanently. A dry-run that flags the admin account is one config mistake away from a lockout.

Error

(dry-run listed the IT admin's own account for deprovisioning; no error text)

Steps

1. Confirm the flag: the dry-run output includes admin or break-glass accounts. Expected: the dangerous candidates identified.
2. Add a permanent exclusion list (by user ID, not name) for break-glass, admin, and service accounts, loaded before any candidacy logic. Expected: exclusions in place.
3. Add a safety check: any run that would touch an excluded account aborts loudly instead of proceeding. Expected: a fail-safe, not just a filter.
4. Re-run the dry-run. Expected: no admin accounts flagged.

When to use

• Dry-runs flag admin or break-glass accounts
• The exclusion list is missing or name-based
• A real run could lock out the team

When not to use

• The flagged account is genuinely deprovisionable (then it is correct)
• The issue is wrongful reclamation of regular users (a rule-tuning problem)
• There are no admin accounts in scope (still keep the safeguard)

Tool compatibility

Any deprovisioning dry-run pipeline.

Variant phrasings

exclusion by name missed a renamed admin

Exclude by immutable user ID; names change.

dry-run is advisory only

Advisory today, automated tomorrow. Build the safeguard now.

Why it happens

Reclamation rules are written for the general population, and admin accounts look inactive by the same heuristics. Without explicit exclusions, the rules apply to everyone.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_qGCNC2uaGhWh6w6x7TOr2w

Resolved from the public thread: https://vectle.com/posts/pst_qGCNC2uaGhWh6w6x7TOr2w

Thread query: license agent's deprovision dry-run flagged the IT admin's own account

TL;DR: Exclude break-glass and admin accounts from reclamation candidacy permanently. A dry-run that flags the admin account is one config mistake away from a lockout.