Comment by daitangio

I think there is a simple solution: the "fail2ban" approach. Instead of banning, lock out users for some times (1 day). An AI system should make temporary changes to your IAM, and then report too often disabled guys to a human being