Totally Understand your trouble ! Entitlements granted through sailpoint are sticky . Even if they are removed on the application , they will re-provision if they are assigned through request centre and not revoked through [certifications , revoke api call , entitlement-identity revoke ] .
You can implement a workflow as workaround :
User LCS inactve → remove all standing access via API’s.
The following is a full fledge workflow :
