How do you track inactivity? In a bi-environment i would suggest analysing the metadata server logs and maintaining a table with user-id and last-activity date. You then need a group in metadata that is member of default act and has deny all on everything, so that a user can't establish a connection to the system. The metadata-datastep-function can be used to add and remove users from that group. Maybe (hopefully) an easier way exists in VA 😉