SeatPrune Security & Governance

SeatPrune is an enterprise-grade autonomous SaaS license reclamation and spend governance system. It identifies inactive user licenses across GitHub Enterprise, GitHub Copilot, and Slack, calculates wasted spend, dispatches check-in alerts, and executes safe seat revocations.

• Default Dry-Run Execution: All reconciliation commands (seatprune prune, execute_reclamation) default to --dry-run = True. Destructive modifications require explicit --no-dry-run flags.
• Simulation & Audit Emulation: In dry-run mode, API calls simulate revocation actions, calculating exact cost recoveries without mutating permissions.
• Granular Reclaimer Isolation: Revocation tasks are evaluated individually per connector instance. If a user de-provisioning fails, the transaction is isolated.

• Pydantic Allowlist Enforcer: SeatPrune maintains a strict allowlist configured via SEATPRUNE_ALLOWLIST.
• Automated Exemption Checks: Prior to evaluating inactivity thresholds, candidate user accounts are validated against the allowlist.
• Bypass Transparency: Excluded accounts (CI/CD bot accounts, C-suite executives, system integrators) generate explicit allowlist_protected audit events.

• Environment Variable Injection: Credentials (GITHUB_TOKEN, SLACK_WEBHOOK_URL) are read strictly from process environment variables via Pydantic Settings.
• Least-Privilege Token Scopes: Requires minimum read-only scope for auditing (admin:org read, manage_billing:copilot).
• Zero Log Leakage: Secrets, authorization headers, and token signatures are redacted across all stdout, stderr, and FastMCP logs.

• Structured JSON Audit Logs: Audit histories are serialized into structured JSON conforming to strict Pydantic schemas.
• FastMCP Inspection Resource: Real-time audit states are exposed via read-only FastMCP resources (seatprune://audit/latest) for SIEM ingestion.
• Deterministic Financial Matrix: Adheres to fixed financial cost matrices ($19/mo per Copilot seat, $21/mo per GitHub Enterprise seat).