This task is for implementation of the Enforcement section of T419622: Verify GrowthBook access approach part 4, and additionally for ensuring tracking of API keys.

What we're looking for is a means of counting the number of distinct GrowthBook users (SSO-based identity should be the same across growthbook-next.wikimedia.org and growthbook.wikimedia.org) who are active, ensuring that active user seating is within plan limits.

There are several ways to handle this. Perhaps the simplest would be a script that emails the Experiment Platform Team on the following:

• Weekly, stats for total users broken down by total/deactivated/active x Read Only/CustomElevatedAccess/Admin, as well as the API keys that are known (across growthbook.wikimedia.org and growthbook-next.wikimedia.org, and any other potential new domain for dev/test/devtest).
• Post access synchronization automation script when a 70% active user threshold (SSO users should be identified by the same email address in any environment) is exceeded for an access class (Read Only or non-Read Only (i.e., CustomElevatedAcces plus Admin)) as described in an IM found with the search "automatic streamlining".

This could be somewhat more fancily done with Prometheus and alerts, of course, although email artifacts are more durable and in some ways simpler.

This task is dropped into sprint 21, but may be dragged into a future sprint.