We are currently using the Advanced server access product and have three different projects within our Team(qa, staging and production), our servers are hosted on amazon AWS, we do not have account wide server enrollment on any project, we enroll servers via per project enrollment tokens which get provisioned on startup.

The issue we are facing is that we are seeing servers from the qa and staging project being enrolled in the production project, we have checked every machine and they have the tokens that correspond to their respective qa and staging projects yet they get enrolled onto the production project.