The weird IP would already be handled by existing zero-trust controls. Users in Entra ID (for example) can be assigned a risk score already based on deterministic factors. On a managed device or not, which MFA methods they have registered, eligible for any privileged roles, where they are, impossible travel detection, etc. You can even require human approvers.

This reads to me to be more for continuous behavioral monitoring once the access is gained via the deterministic controls. You wouldn't leave "Can person X access resource Y" up to the AI model, that's already decided based on the existing rules. Where the model comes in is "Is person X behaving in an expected way while using resource Y." Like, downloading a bunch of data when they've never done that before, might get flagged for either a session revocation, or a human review, or prompt for additional authentication, etc.