Have you checked your Auto-Generated Provisioning Rules are generating rules correctly?

Summary:

I was demonstrating provisioning rules to a client and found a surprise.

Disabled ALL Access Controls. Purged All Incidents.

Generated Auto-provisioning rules.....expected nothing to get created and BOOM.. Where the heck did these rules come from?

So... I checked and we have models that match the control being indicated in the provisioning rules but that is really unexpected. There are no active controls and none that match the model itself.

Are provisioning rules generating based on models? Documentation states that they use "Active Controls" so I would expect a blank screen. The initial test was because client noticed we cannot remove provisioning rules and I took the bait and assumed I could inactive my controls and then regenerate the provisioning rules.