The risky part is not the button. It is the missing review.
- Equating inactive with safe to remove
- Ignoring service accounts and automation identities
- Cleaning up local access that is controlled by an IdP owner
- Keeping no record of rows deliberately held out