Nice Picture. Now Delete the Account.

There’s a software demo going around right now. It’s good. Watch it if you get the chance.

A VP of Finance leaves the company. The screen lights up: her account is gone, but an AI assistant she set up eight months ago is still running, still using her permissions. That assistant has a password saved into another account. That account can change anything in the systems that run the business.

Three steps from a departed employee to everything.

The room goes quiet, because nobody in it can show that picture for their own company.

The demo is right. People create AI assistants to do their jobs faster. Those assistants borrow their creator’s permissions, keep running after their creator quits, and never show up in the process HR uses to shut someone off. Any vendor telling you they solved this already is not being straight with you. We hadn’t either.

So grant it. Then ask the question nobody asks while everyone’s still staring at the screen.

What happened after the demo?

It can see. It can’t do.

Look at how the software works instead of how the story goes.

It gets its picture by reading from the login system you already own — Okta, Microsoft Entra. It pulls a copy of who has what. It sorts, scores, and recommends. Then it can switch access off.

See and switch off. That’s the whole range.

Which means it can’t create an account for a new hire. Can’t reset a password. Can’t unlock someone at 6am. Can’t send a login code, can’t run your sign-in, can’t give an employee a screen where they ask for access to a folder.

That isn’t a missing feature. It’s the design. Software whose entire job is to describe other systems has to read from them — and reading isn’t running.

“Replace five tools” usually means “add a sixth”

Test the pitch against what you actually own.

Buy it tomorrow and you still need the thing that sets up accounts from your HR system. Still need password reset and unlock, which is most of what your help desk does all day. Still need your sign-in and login codes. Still need connections into the older systems that never moved to the cloud — which is exactly where your worst forgotten access has been sitting for twenty years.

None of that goes away. You added a tool, you didn’t remove any.

That can be money well spent. Just don’t let it quietly redefine the job as spotting problems, when the job was always fixing them.

Three questions to ask any vendor

Ask it to finish something. Not flag it. Pick one forgotten account and ask them to remove that access everywhere it exists — including your older systems — and hand you the record proving it’s gone. Watch who they pass the work to.

Ask where the employee is. Every company eventually has someone locked out on a Sunday. Ask to see what that person sees.

Ask for the list of systems they connect to, in writing. Not “anything, in hours.” The list. Everyone connects to the popular cloud apps. Ask whether they’ll put in writing that they reach your mainframe, your ERP, your medical records system.

What we want to be judged on

Not the picture. Whether the access was actually removed, everywhere it existed, with proof an auditor accepts — including when the thing holding that access was never a person.

Seeing is the easy half. It’s also the half being sold hardest right now.

Ask us to finish something. That’s the test.

---

Identity Anywhere 2027 — free to start, deployment included, 45-day money-back guarantee.