Identity & SCIM

OIDC providers and lifecycle sync

• Google Workspace OIDC is first-class.
• Okta profile available.
• SCIM baseline for user lifecycle sync.

See infra/IDENTITY-SCIM-RUNBOOK.md in the repo for the setup runbook.

Principals

Humans (OIDC) and agents (API keys / OAuth tokens) are evaluated by the same ACL engine — see Ownership & access control.