Treat AI licences as a five-stage lifecycle: provision, observe, right-size, reclaim, offboard. Idle seats are detectable through vendor APIs, notably GitHub's copilot/billing/seats endpoint with its last_activity_at field and Cursor's per-member spend endpoint, though both come with caveats. Right-sizing means matching a tier to a usage pattern rather than buying one plan for everyone, and offboarding means revoking tokens and rotating keys, not just removing the seat, because a token minted for CI is valid for a year regardless of what the identity provider says.
- Five stages: provision, observe, right-size, reclaim, offboard. Most programs do the first and last badly and skip the middle three.
last_activity_aton the Copilot seats endpoint is the standard signal, but it only records when IDE telemetry is enabled.- Seat removal sets pending cancellation: access ends at the billing cycle, so the saving lands next month, not today.
- Right-size by usage pattern, not by title. A staff engineer who reviews all day needs less tier than a mid-level who drives an agent.
- The offboarding gap is long-lived tokens. A
claude setup-tokencredential is valid for a year and lives wherever it was pasted.
The lifecycle
01 · Provision
Decide the default tier and the request path before the first seat. The single biggest driver of shadow AI is a provisioning queue longer than the developer's patience. Assume that if the sanctioned tool takes two weeks to obtain, some fraction of the team will pay personally and expense it, or worse, not expense it.
02 · Observe
Collect two numbers per seat: last activity, and consumption. Neither alone is enough. Last activity catches abandonment; consumption catches the person on a $200 tier using $30 of it, and the person on a $20 tier who is rate-limited every afternoon.
03 · Right-size
Move people between tiers based on the second number. This is the stage almost nobody runs, and it is where the money is on both sides: reclaimed spend from over-provisioned seats, and recovered productivity from under-provisioned ones.
04 · Reclaim
Remove seats with no activity, after asking. A reclaim that surprises someone who was on parental leave costs more goodwill than the seat costs money.
05 · Offboard
Identity provider, vendor seat, tokens, keys, and paired devices. In that order, and all five. See the checklist below.
Finding the idle seats
Vendors expose this unevenly. Here is what is actually available in August 2026.
| Vendor | Signal | Endpoint | Caveat |
|---|---|---|---|
| GitHub Copilot | last_activity_at, last_activity_editor | GET /orgs/{org}/copilot/billing/seats | Only populated when IDE telemetry is enabled |
| Cursor | Per-member spendCents and daily usage | /teams/spend, /teams/daily-usage-data | Requires a team admin key |
| Anthropic (Claude Code) | Per-user sessions and estimated cost, daily | /v1/organizations/usage_report/claude_code | One day per request; API-only, excludes Bedrock and Vertex usage |
| Anthropic (API keys) | Usage by api_key_ids[] | /v1/organizations/usage_report/messages | Attributes keys, not people |
| Local agent logs | Per-machine sessions and spend, retroactive | On-disk transcripts | Per machine, not per licence |
gh api --paginate "/orgs/$ORG/copilot/billing/seats" --jq '
.seats[]
| select(.last_activity_at == null
or (.last_activity_at | fromdateiso8601) < (now - 45*86400))
| [.assignee.login, (.last_activity_at // "never"), (.last_activity_editor // "-")]
| @tsv' | sort -k2
# and the reclaim, one person at a time, after you have asked them:
gh api -X DELETE "/orgs/$ORG/copilot/billing/selected_users" \
-f "selected_usernames[]=$USERNAME"Right-sizing the tier
Buying one plan for everyone is the default and it is wrong in both directions at once. The right axis is usage pattern, measured, not seniority or team.
| Pattern | Signal | Right rail |
|---|---|---|
| Occasional: a few prompts a week | Under $10/mo of token value | Free tier, or a shared API key |
| Steady: an agent for part of the day | $30 to $120/mo of token value | A mid subscription tier |
| Full-time agent driver | Over $200/mo of token value, or hitting caps weekly | A top subscription tier |
| Reviewer-heavy | High session count, low output tokens | A mid tier; the cheaper model handles it |
| CI, cron, evaluations | No human attached | A scoped API key, never a seat |
The last row is the one that quietly overspends. Automation given a human seat is a licence charged monthly for a workload that runs in bursts, and it also destroys your attribution, because the automation's spend now shows up as a person's.
Offboarding: the part with the gap
Removing someone from the identity provider is necessary and not sufficient. Credentials minted while they had access keep working until something explicitly revokes them.
- Identity provider. Remove the account. On some platforms this cascades: Continuum, for example, treats removal in WorkOS as the offboarding trigger that blocks provider access, revokes devices and tokens, and destroys the content key.
- Vendor seat. Remove the Copilot, Cursor, or Claude seat explicitly. Remember pending cancellation means the seat is still billed to the end of the cycle.
- Long-lived tokens. The real gap.
claude setup-tokenmints a one-year OAuth token that is printed once and pasted wherever the person needed it, typically a CI secret. It is not stored by the CLI and logging out elsewhere does not revoke it. Enumerate and revoke. - API keys. Any key the person created or could have copied is rotated, not deleted-if-unused. This is why per-project keys with named owners are worth the setup.
- Paired devices and sessions. Agent workbenches pair laptops, phones, and remote hosts. A revoked account with a live paired device is a real access path.
- Shared credentials they held. The database URL in the team password manager, the gateway key in the runbook. Nothing about AI makes this different, and nothing about AI makes it less likely to be skipped.
The quarterly review
Thirty minutes, four times a year, against a fixed list. The point of writing it down is that it happens when nobody is thinking about cost.
- Pull every seat across every AI vendor into one list. The surprise is usually a tool one team bought that nobody else knew about.
- Flag seats with no activity in 45 days. Ask before reclaiming; parental leave and sabbaticals look identical to abandonment in the data.
- Flag seats consuming under 20% of their tier's value, and seats hitting caps weekly. Move both.
- Reconcile the seat list against the current headcount export. Leavers who kept a seat are the highest-value find in this exercise.
- Check whether any seat is really automation. Move it to a scoped API key.
- Re-read the model defaults. A default set six months ago is pointing at a tier that has since been repriced or superseded.
- Record what changed, including the reclaims you decided against and why. Next quarter's reviewer needs to know that seat was already considered.
Questions people ask
How do I find unused GitHub Copilot seats?
Call GET /orgs/{org}/copilot/billing/seats and filter on last_activity_at. Each seat object also carries last_activity_editor, created_at, and pending_cancellation_date. Two caveats from GitHub's own documentation: last_activity_at is only populated when telemetry is enabled in the user's IDE, so a null value is not proof of non-use, and removing a seat sets it to pending cancellation with access ending at the close of the billing cycle rather than immediately.
What is AI seat management?
AI seat management is the lifecycle of paid AI licences across an organization: provisioning them quickly enough that people do not route around the process, observing activity and consumption per seat, moving people between plan tiers to match how they actually work, reclaiming dormant seats, and fully revoking access on offboarding including tokens and API keys, not just the seat itself.
How much do idle AI seats cost?
At GitHub Copilot Business pricing of $19 per user per month, thirty dormant seats is $570 a month and $6,840 a year. At a $100 per seat premium subscription tier, ten dormant seats is $12,000 a year. Idle seats are the single most reliable AI saving available because the number comes off a real invoice rather than out of an efficiency estimate.
What gets missed when offboarding someone from AI tools?
Long-lived tokens, almost always. A token minted by claude setup-token is valid for a year, is printed once rather than stored, and typically ends up in a CI secret that survives the person leaving. API keys they created or copied are second, paired devices on agent workbenches are third. Removing the identity-provider account and the vendor seat is necessary and does not revoke any of those three.
Should automation get its own AI seat?
No. Give it a scoped API key instead. A seat is priced monthly for a human, while automation runs in bursts, and putting CI on a person's seat destroys your attribution because the job's spend then appears as that person's usage. Separate keys also let you tell a runaway retry loop apart from a busy engineer, which is the distinction that matters at 3am.
How often should we review AI seats?
Quarterly is enough for most organizations, and it should be a written checklist rather than an ad hoc audit. Pull every seat across every vendor, flag anything dormant for 45 days, flag anything using under 20% of its tier and anything hitting caps weekly, reconcile against the current headcount export, and record what you decided not to change so the next reviewer does not redo the analysis.
Sources
Every figure above was read from these pages on August 2026. Vendors reprice without notice; if you find a stale number, tell us.