A system comprising: a plurality of devices configured with a portable user account to synchronize account events to a distributed log, the plurality of devices including at least one device that includes memory and at least one processor configured to execute instructions, the instructions including: in response to receiving, by the at least one device of the plurality of devices and from at least one other device, a request to access the portable user account, triggering a query to determine access rights for the at least one other device, the request including information associated with the at least one other device; in response to receiving an approval response to the query: assigning a provision status to the at least one other device, the provision status indicating whether the at least one other device is assigned as an inner entity or as an outer entity for the portable user account, wherein the at least one other device, assigned as the inner entity, is configured to provision the portable user account on other devices and revoke access to the portable user account for the other devices, and wherein the at least one other device, assigned as the outer entity, is configured to not provision devices for use with the portable user account, providing, for the at least one other device, access to at least a subset of the portable user account according to the provision status, and updating the distributed log to include the at least one other device based on the provision status. in response to receiving, by the at least one device of the plurality of devices and from at least one other device, a request to access the portable user account, triggering a query to determine access rights for the at least one other device, the request including information associated with the at least one other device; in response to receiving an approval response to the query: assigning a provision status to the at least one other device, the provision status indicating whether the at least one other device is assigned as an inner entity or as an outer entity for the portable user account, wherein the at least one other device, assigned as the inner entity, is configured to provision the portable user account on other devices and revoke access to the portable user account for the other devices, and wherein the at least one other device, assigned as the outer entity, is configured to not provision devices for use with the portable user account, providing, for the at least one other device, access to at least a subset of the portable user account according to the provision status, and updating the distributed log to include the at least one other device based on the provision status. assigning a provision status to the at least one other device, the provision status indicating whether the at least one other device is assigned as an inner entity or as an outer entity for the portable user account, wherein the at least one other device, assigned as the inner entity, is configured to provision the portable user account on other devices and revoke access to the portable user account for the other devices, and wherein the at least one other device, assigned as the outer entity, is configured to not provision devices for use with the portable user account, providing, for the at least one other device, access to at least a subset of the portable user account according to the provision status, and updating the distributed log to include the at least one other device based on the provision status. <EOS>