Connect with us

Tech Features

Provisioning and Deprovisioning – A Guide to Stronger Identity and Access Management

Published

on

Access Management

By: Christopher Hills, Chief Security Strategist, BeyondTrust

Across the Middle East, CIOs and CISOs huddle together to determine ways of making their organizations more secure so that digitalization can align with the vision of business leaders. No enterprise can afford to shut itself off from the digital economy. Whether it operates locally, regionally or globally, a business must build trust. And to do that, it must master the art of identity management. Therefore, it must understand the importance of provisioning and deprovisioning.

Provisioning is the name we give to the granting of privileges. This is a more granular process than onboarding, in which a new user account is created. Each user may have privileges granted at any time. And we should remember that not all users are humans — employees, contractors, customers, and so on. Privileges may be assigned to service accounts, machinery, and other resources. The purpose of provisioning is to maintain access while accounting for security and compliance standards.

To meet modern security standards, however, deprovisioning is just as important. Again, this does not just occur during offboarding. Privileges can be revoked all the time. Not because of a loss of trust in the person or asset that held them, but because it is best practice. Effective provisioning and deprovisioning is the foundation of a robust identity-centric security solution.

Covering the bases

Both are important. Overprovisioning can lead to a junior employee or overlooked service having unnecessary privileges, and under-deprovisioning can lead to a range of invisible issues such as unmonitored or orphaned accounts, or stale privileges. Special care must also be taken when adding or removing accounts to user groups — which carry with them a predetermined set of privileges —because these actions amount to provisioning and deprovisioning.

Any active account is a potential entry point, so it should come as no surprise that security best practice lies in minimizing the number of accounts and the access privileges they hold. If an account is no longer needed — an employee has resigned, a project has come to an end, or a range of other scenarios — then it should be disabled, deleted, or its rights downsized. Threat actors rely on organizations not following this simple practice.

Tools and tricks

Robust IAM will also include just-in-time (JIT) provisioning, which goes hand in hand with PoLP. When deprovisioning occurs, the timely revocation of access also occurs. Regularly reviewing and adjusting access rights is best practice because it prevents unnecessary permissions being exploited by malicious parties inside or outside the organization. All unused accounts should be placed in a disabled state and removed from all relevant security groups until such time as they can be reviewed and, if appropriate, deleted.

Identity and access management cannot be effective without the right tools to simplify provisioning and deprovisioning. This is because looking after the end-to-end lifecycle of identities, privileges, and entitlements is a complex task that has grown even more complex since the region’s mass migration to hybrid and multi-cloud environments. Identity management tools can streamline the creation, maintenance, and deletion of human and non-human accounts. Governance management tools enforce policies that limit access based on the assigned privileges. Lifecycle management tools are useful for ensuring (from onboarding to offboarding) that privileges always fit the role of an account owner. Privileged access management (PAM) enforces PoLP and provides a useful integration hub for other tools so that IT and security teams have single-pane control over everything that may impact identity security.

In a modern setting, provisioning and deprovisioning tools must offer automation and user behavior analytics, which means they must incorporate some flavor of AI or machine learning. To be consistent with the implementation of PoLP and other governance policies, variants of AI are necessary to minimize human error. Granting and revoking access rights in a company of even moderate size is a constant process that responds to changes in personnel and circumstances. While some of these situations may be subject to planning, others, such as real-time behavioral anomalies, are not. Threats can arise at a moment’s notice and only AI offers a practical option for timely response.

Be strong

Having established provisioning and deprovisioning as the keys to strong IAM, enterprises will find they can implement more effective lifecycle management of identities, privileges, and entitlements. As with any new measure, ongoing reviews will uncover any additional requirements, and adjustments can be made to cover new regulations, new assets, or new business models. As the identity landscape fluctuates, so should provisioning and deprovisioning strategies.

Define roles clearly. If an account owner does not need access to a resource, do not grant it (PoLP); and if they do, wherever possible, grant access only for as long as it is required (JIT). Disable and delete accounts where appropriate and monitor access across the entire ecosystem as often as is practical — quarterly or annually.

Following the guidance laid out here will strengthen your identity security posture. The modern threat actor is always on the lookout for gaps in your defenses. Unfortunately, these often take the shape of overprovisioned identities or abandoned accounts that have not been adequately addressed. The good news is that by applying the steps above, you can shore up defenses and protect the enterprise from the worst of the threats beyond its walls.  

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech Features

When power becomes the bottleneck, efficiency becomes capacity

Published

on

Kayvan Karim, Programme Director of MSc Software Engineering, School of Mathematical and Computer Sciences, Heriot-Watt University Dubai 

For the past few years, the AI infrastructure race has largely been measured in scale: more GPUs, larger data centres and greater power capacity. That expansion is continuing, but the economics are beginning to change. Competitive advantage may increasingly depend not only on securing additional power, but on extracting more useful AI work from the power already available. Part of the reason is a change like AI demand. We are moving from relatively simple prompt-and-response systems towards agents that can reason across multiple steps, call tools, inspect results, revise plans and continue working autonomously. Anthropic’s latest Economic Index notes that Claude usage is increasingly shifting towards long-running agentic tasks and that more computationally intensive conversations tend to be associated with higher-value outputs.

This transition could have significant implications for infrastructure demand. A chatbot might generate one answer to one prompt. An agent performing a software-development, research or business task may invoke a model dozens of times, maintain a large context, call external tools and generate many intermediate reasoning steps before producing an outcome. Demand may therefore grow in two ways: more people using AI and more inference, model calls, and tokens processed for each task. Major AI laboratories are already working on this efficiency problem. OpenAI says one of its primary inference objectives is to serve more tokens from the same hardware, using techniques including scheduling, caching, kernel optimisation and improved model implementation. It also describes GPT-5.6 as being trained to accomplish more work per token. Google DeepMind is pursuing a similar direction: its Gemini 3.6 Flash was designed for scaled agentic workloads and uses fewer output tokens than its predecessor on several evaluations. In contrast, its recent agentic video system reduced token consumption by up to 88% for that workload.

Other approaches address efficiency at the model architecture level. DeepSeek-V3, for example, uses a Mixture-of-Experts design with 671 billion total parameters but activates 37 billion per token, so only part of the network is used for each computation. Meta has similarly worked on inference efficiency through grouped-query attention and more efficient tokenisation; the Llama 3 tokeniser was reported to require up to 15% fewer tokens than Llama 2 for equivalent text. Taken together, these approaches show that model capability is increasingly being developed alongside the cost of delivering it.

Model-level efficiency, however, is unlikely to remove the infrastructure constraint on its own. Global data-centre electricity consumption was approximately 415 TWh in 2024, according to the International Energy Agency, and its base case projects this to reach around 945 TWh by 2030. AI is expected to drive most of that growth. Efficiency is therefore improving while aggregate demand continues to rise. One reason is the Jevons, or rebound, effect: efficiency improvements reduce the resources required for each unit of work, but lower costs can also encourage greater overall use. If agents become much cheaper to operate, organisations may respond by deploying more of them, running them for longer, or applying them to tasks that were previously uneconomic. Efficiency can reduce the compute required for an individual task while still increasing total demand.

That increased demand meets infrastructure that cannot expand as quickly. Models and software can improve quickly, but grids, substations, transformers and power-generation infrastructure usually have much longer development cycles. The IEA notes that while a data centre can sometimes be developed within two or three years, the broader energy infrastructure required to support it often involves longer planning and construction periods. Where grid capacity is constrained, each available megawatt becomes a more valuable production resource. The amount of power available remains important, but so does the amount of useful computation that can be produced within that power envelope.

That changes how we should understand capacity. Improvements in accelerator performance, model architecture, workload scheduling, caching, utilisation and inference software can increase computational output without increasing a site’s electrical connection. OpenAI’s recently reported Jalapeño inference hardware illustrates the direction of travel: the company says the chip can deliver more AI work per unit of power while increasing throughput and reducing latency. Efficiency can therefore act as a form of virtual capacity. If two operators each control 100 MW, but one can consistently deliver substantially more useful AI work within that power envelope, their nominal capacity may be identical while their productive capacity is not.

The same constraint applies to physical space and cooling. AI systems are concentrating more computational power into individual racks, increasing both power density and heat output. Packing more accelerators into the same building only creates useful capacity if the electrical and thermal infrastructure can support them. This is one reason liquid cooling is moving from a specialist technology towards a more central part of AI data-centre design. Microsoft, for example, has introduced a closed-loop chip-level cooling architecture that it says eliminates evaporative water consumption for cooling and could avoid more than 125 million litres of water annually per data centre. The example also shows why power, cooling, water use and rack density cannot be treated independently.

The same shift creates a measurement problem. Power Usage Effectiveness, or PUE, has been valuable for showing how much facility energy is required beyond the electricity IT equipment consumes. It does not, however, measure whether that IT equipment is producing useful work efficiently. Uptime Institute’s 2025 survey placed average PUE at around 1.54 and noted that the headline industry figure had changed little for six years. Uptime has consequently argued for productivity measures that relate computational work to energy consumption. For AI inference, tokens per kilowatt-hour might offer one operational measure. Still, even that is incomplete: an efficient model that solves a task in 1,000 tokens may be more valuable than one generating 10,000. A more useful long-term measure may therefore be useful AI work per unit of energy, water and infrastructure.

Capacity will remain essential. The AI industry will continue to build larger data centres, secure new power supplies and deploy large quantities of computing hardware. As agentic systems create more persistent inference demand and physical resources become harder to expand, however, efficiency may increasingly determine the productive value of that capacity. Operators that can support more useful computation within the same power, cooling, water, and space constraints can accommodate more workloads without waiting for equivalent growth in physical infrastructure.

For AI infrastructure, installed megawatts will remain a headline measure. The more consequential measure may increasingly be how much useful AI work those megawatts can support.

Continue Reading

Tech Features

Alteryx Launches New AI Capabilities to Bring Governed Analytics Anywhere Work Happens

Published

on

Alteryx, the agentic analytics and automation company, today announced new AI capabilities across Alteryx One that connect enterprise-grade business logic directly to the AI agents’ teams already use. By extending governed workflows and datasets to external AI tools, organizations can “build once and govern once,” eliminating the need to recreate complex business logic from scratch. This approach allows enterprises to scale AI action with confidence, helping to reduce both security risks and runaway token costs.

Key Findings

  • 71 percent of IT leaders report that AI initiatives are most successful when IT and business teams collaborate closely to bridge the gap between AI agents and enterprise business logic.
  • NextWave achieved a 20x reduction in LLM token consumption using an Alteryx workflow during a complex Office of the CFO reconciliation between front-office and back-office data.
  • Up to 93 percent reduction in token consumption and up to 85 percent increase in speed on tasks involving raw, ungrounded data, when combining an LLM with an existing, trusted Alteryx workflow.
  • Up to 83 percent reduction in token costs and up to 65 percent increase in speed on tasks involving clean, grounded data.
  • 65 percent of analysts confirm that AI delivers the most value when business logic is managed at the business level.

“Generative AI is brilliant at brainstorming, but it often struggles with the precision required for enterprise execution. Organizations don’t need agents that guess at business rules and burn through tokens; they need AI that operates on the same trusted business logic and governance that underpin the rest of the business,” said Ben Canning, Chief Product Officer at Alteryx. “By connecting existing tools to a governed business logic layer, we are allowing enterprises to stop the ‘re-work’ tax of rebuilding business rules for every new agent, ensuring that every AI-driven action is as reliable as the calculations they already trust.”

New Capabilities

The latest capabilities include:

Ask Alteryx: With this release, Ask Alteryx evolves from an embedded assistant into the primary way users interact with Alteryx One, guiding new users step-by-step through their first workflow in Designer and giving everyone a natural-language front door to their data through Ask Alteryx for Live Query, with connections to Snowflake, Big Query, and Databricks for reading and writing data directly. Ask Alteryx checks existing workflows and data first, delivering a governed answer when one exists or building a new workflow when it doesn’t, with every output remaining inspectable, editable, reusable, and schedulable within Alteryx One.

Agent Studio: Enables business users to turn existing, already-governed datasets into conversational agents without rebuilding anything. Analytics teams maintain full control over which datasets and KPIs power agent responses, while finance and operations departments can instantly scope an agent to their reconciliation dataset or KPI dashboard data, so stakeholders can ask trend, root-cause, and variance questions in plain language and get governed, explainable answers back.

Alteryx Insights for OpenAI: Available through the ChatGPT Plugin Directory, this capability allows business users to generate answers based on analyst-approved data, calculations, and workflows. Employees can investigate revenue variances or resolve reconciliation issues directly, accessing trusted business logic without opening the platform or requiring an Alteryx seat. Alteryx will be expanding this surface integration strategy to bring governed logic to where teams already collaborate, including upcoming support for Claude, Gemini, Slack, and Microsoft Teams.

Alteryx MCP Server: The governed way to use Alteryx from whatever AI platform or agent you already work in. It lets AI agents interact with Alteryx as easily as a human would, finding the right data, building multi-step solutions, and turning them into governed, repeatable workflows. Agents can build, run, schedule, and discover Alteryx assets directly, with external AI requests inheriting Alteryx’s authentication, workspace context, role-based access controls, and permissions automatically, so every interaction carries the same security model and audit trail as if a person had done it. More capabilities, including connection creation and expanded scheduling, are expected to roll out later this year on the same governed connection.

Alteryx Skills: A GitHub install that teaches third-party agentic interfaces, OpenAI Codex, Microsoft Copilot, Claude Code, Gemini CLI, and more, how to build Alteryx assets the right way, closer to how Ask Alteryx already builds them. Rather than each tool guessing at Alteryx’s patterns on its own, Skills gives them Ask Alteryx’s own workflow-building know-how, so a financial calculation or reconciliation workflow gets built correctly the first time, without rebuilding logic or permissions separately for every tool your team uses.

Continue Reading

Tech Features

The Infrastructure Is Automated. Why Are the Processes Around It Still Manual?

Published

on

Article by Prasanna Rajendran, Vice President – EMEA, Kissflow

Across the Middle East, governments and enterprises are investing heavily in cloud infrastructure to support national digitization agendas, from Vision 2030 in Saudi Arabia to the UAE’s push toward AI-driven government services. Gartner forecasts that IT spending across the Middle East and North Africa will reach $169 billion in 2026, an 8.9 percent increase over 2025, with software spending alone growing 13.9 percent.

Infrastructure as code (IaC) is the practice of defining and provisioning computing infrastructure, including servers, networks, databases, and load balancers, using machine-readable configuration files rather than manual processes or interactive consoles. Rather than logging into a console to click through setup wizards, teams describe their entire infrastructure in version-controlled code that can be reviewed, tested, and deployed like any other software artifact.

For CIOs and IT leaders, this matters because IaC has become the operational standard for any organization running workloads at scale. Grand View Research valued the global IaC market at $1.2 billion in 2025 and projects it to reach $6.1 billion by 2033, a compound annual growth rate of 22.3 percent. That trajectory reflects a clear shift: enterprises are moving from manual, ticket-driven infrastructure management to automated, code-driven provisioning.

What is infrastructure as code?

At its core, IaC means defining resources such as virtual machines, storage volumes, network configurations, security policies, and access controls in declarative or imperative code files. Those files become the authoritative record of what your infrastructure looks like at any moment.

IaC generally follows one of two approaches, depending on whether teams want to define an outcome or prescribe the route to it. Declarative IaC describes the desired end state: you specify what you want, such as three servers, a load balancer, and a database cluster, and the tool works out how to get there. Terraform, AWS CloudFormation, and Azure Bicep all use this method. Imperative IaC instead specifies the exact steps to reach an outcome. You write procedural instructions: create this server, then attach this disk, then configure this network. Ansible and Chef follow that model more closely.

The declarative approach dominates enterprise adoption today because it is easier to maintain and less error-prone. You describe the outcome rather than the procedure, which keeps the code readable even as infrastructure complexity grows.

What separates IaC from traditional infrastructure management is version control. Every change is tracked in Git, reviewed through pull requests, and deployed through automated pipelines. This is the mechanism Gartner points to when it describes IaC as the route to cloud governance and self-service at scale.

Why infrastructure as code matters for enterprise IT

Manual infrastructure management does not scale. When an operations team provisions servers through tickets and console clicks, every environment differs slightly, every deployment carries risk, and every audit turns painful. IaC removes these problems systematically.

Consistency and reproducibility

IaC guarantees that the development, staging, and production environments are consistent. Configuration drift, the slow divergence of environments over time, disappears because every deployment is generated from the same code. When an incident occurs, you can rebuild an environment from scratch in minutes.

Speed and agility

Organizations using IaC provision entire environments in minutes rather than weeks. When business conditions change, whether through a product launch, a capacity spike, or a compliance deadline, IaC lets you respond at the speed of code.

Security and compliance

With IaC, security policies are embedded directly in infrastructure templates. Guardrails apply automatically. Compliance checks run in the CI/CD pipeline before any change reaches production. Security stops being a gate at the end of the process and becomes part of how infrastructure gets built.

Cost efficiency

IaC gives you precise control over resource provisioning. Idle capacity gets identified and decommissioned through code rather than through quarterly manual audits. Cost discipline has grown into a standing function for this reason: 59 percent of the 759 organizations Flexera surveyed for its 2025 State of the Cloud Report now run a dedicated FinOps team, up from 51 percent the year before.

Key infrastructure as code tools for the enterprise

Several tools now anchor enterprise IaC strategy, each suited to a different environment. Terraform and its open-source fork, OpenTofu, remain the dominant choice for cross-cloud work, offering declarative provisioning across multiple clouds using HCL. Organizations standardized on a single cloud often turn to native alternatives instead: AWS CloudFormation for AWS-centric environments, using JSON or YAML, and Azure Bicep for Azure-native deployments. Ansible takes an imperative, YAML-based approach and excels at configuration management and application deployment rather than pure provisioning. Pulumi appeals to developer-led teams by letting them define declarative infrastructure in familiar languages such as Python, TypeScript, or Go.

Common challenges when adopting infrastructure as code

Adopting IaC is not without friction. The most immediate obstacle is usually a skills gap, because IaC asks infrastructure teams to work the way developers do, with version control, code reviews, and CI/CD pipelines. That shift is cultural as much as it is technical, and it requires deliberate investment in training.

State management adds complexity of its own. Declarative tools maintain state files that track current infrastructure, and multi-team environments need remote state backends, locking, and workspace isolation from day one to avoid conflicts.

Legacy system integration is another common obstacle, since not everything can be expressed in code immediately. Most organizations start with new cloud workloads and progressively extend IaC to existing systems through API wrappers.

Governance and drift detection require ongoing discipline. IaC only delivers its full value once it becomes the sole path for infrastructure changes, which makes continuous drift detection and sustained cultural enforcement critical rather than optional.

Where workflow automation fits in an IaC-driven enterprise

Infrastructure as code solves the provisioning problem. Enterprise IT complexity does not stop there. The layer above IaC, covering the processes, approvals, and operational logic that run on top of provisioned infrastructure, is where most organizations still depend on fragmented tools, manual handoffs, and spreadsheet-based tracking. That gap is especially visible across the Middle East, where cloud adoption and ambitious national targets often outpace the operational processes needed to govern them.

Regulatory pressure widens the gap further. Gartner forecasts worldwide sovereign cloud IaaS spending at $80 billion in 2026, a 35.6 percent rise over 2025, with governments as the main buyers. Provisioning infrastructure inside a national boundary is one requirement. Proving that every approval, exception, and access grant on that infrastructure followed a governed path is another, and code alone does not answer it.

This is where workflow automation platforms operate as a digital backbone for enterprise operations. IaC automates the infrastructure layer. A no-code or low-code workflow platform automates the process layer: IT service requests, change management approvals, vendor onboarding, compliance workflows, and the hundreds of cross-functional processes that connect people, systems, and decisions across the enterprise.

For IT leaders across the region pursuing IaC adoption, particularly those operating under strict data residency and regulatory requirements, this kind of platform complements the strategy by giving business teams a way to build and manage operational workflows without adding to the IT backlog. IaC handles your infrastructure. Workflow automation handles everything that runs on it.

See how Kissflow governs the change approvals, access requests, and compliance workflows that sit on top of your cloud infrastructure in a 30-minute demo.

Continue Reading

Trending

Copyright © 2023 | The Integrator