How do staff get access to an office AI? Named accounts, approved by a person, removed on the last day.
Short answer. Each person should have their own named account, created on a person’s approval and removed on the day they leave. A sound set-up links the AI to the office’s existing sign-in (single sign-on through Google Workspace, Microsoft or a directory), so joiners and leavers are handled in one place and multi-factor authentication comes with it. Avoid shared logins, because the audit trail can then not say who asked what. If you use local passwords, NIST’s current guidance asks for at least 15 characters when the password is the only factor, a blocklist of common passwords, and no forced periodic changes.
01
A joiner, mover, leaver routine
Joiner: the manager asks, the AI owner approves, and the administrator creates the account with the lowest role that does the job.
Mover: when someone changes team, change their groups that week and remove access that no longer fits.
Leaver: disable the account on the last day, revoke any API keys and check the shared collections the person owned.
Every quarter: list active accounts, compare them with the staff list and remove dormant ones.
Record each change. NIST’s account management control (AC-2) asks for approvals before accounts are created, monitoring of use, and account processes aligned with staff termination and transfer.
02
Sign-in options compared
Option
How it works
Good for
Watch for
Local accounts
Username and password stored in the AI product
Very small offices, or the first week of a pilot
Reused passwords; no central removal of leavers
Single sign-on (OIDC)
The AI product trusts your identity provider, such as Google Workspace or Microsoft Entra
Offices that already have one
The provider must be reachable from the box. Ask what happens if it is down.
Directory (LDAP)
The box checks users against an office directory
Offices with an on-premise directory
The directory must be reachable and kept tidy
Shared login
One account for many people
Nothing
No individual accountability: the log shows the account, not the person
03
If you use local passwords
Length over complexity: NIST SP 800-63B-4 requires at least 15 characters when a password is the only factor, and at least eight when it is one part of multi-factor sign-in.
No composition rules such as “one symbol and one capital”.
No scheduled changes. Force a change only when there is evidence of compromise.
Reject passwords that appear on a blocklist of common or breached passwords.
Add a second factor for administrators.
04
New accounts start as pending
Open WebUI’s documentation recommends that new sign-ups start in a “pending” state with no access until an administrator approves them, and its hardening guide says to keep open registration off and to use single sign-on with the local login form disabled. The same pattern suits any office AI: nobody should be able to create their own way in.
Named accounts also make the cost visible. Appliances and licences are often sized by named users, so the account list is a cost list as well as a security list.
05
What ANVE says
ANVE is sized by named users. The launch line-up covers 1 to 3 (ANVE One), up to 25 (ANVE Office) and up to 100 (ANVE Office Pro), with ANVE Estate on quote above that. It has two roles today, administrator and user. An administrator adds cloud models and approves connectors.
Teams, finer roles and single sign-on are not on ANVE yet (see /security). Whether it enforces multi-factor authentication and how leavers are removed are not stated here. ANVEAI confirms them in writing before a paid pilot.
06
Questions people ask
Can two people share one login to save a licence?
Do not. The record of AI use then names the account, not the person, and cutting a leaver’s access also cuts their colleague’s.
What about contractors and interns?
Give them named accounts with an end date, the lowest role and access only to the collections they need. Remove them when the engagement ends.
Do we need multi-factor authentication on our own network?
For administrators, yes. NIST’s zero trust guidance says network location alone should not imply trust, and its remote-access guidance prefers multi-factor authentication.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
