Support tenant-scoped directory lifecycle with isolation tests

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md

@@ -0,0 +1,43 @@
+---
+id: NK-WP-0038
+type: workplan
+title: "Tenant-scoped identity lifecycle for account journeys"
+domain: infotech
+repo: net-kingdom
+status: active
+owner: codex
+topic_slug: infotech
+created: "2026-09-13"
+updated: "2026-09-13"
+---
+
+## Implement scoped directory access changes
+
+```task
+id: NK-WP-0038-T01
+status: done
+priority: high
+```
+
+Support USER-WP-0029 T06: /v1/identities/tenant-access changes only the target
+tenant's users/admins groups, never deletes the identity, clears global suspension
+or touches other tenants. Validate tenant/role/status; verify readback before
+reporting success. Repeated desired-state requests converge. Preserve original
+identity-wide owner operations for explicitly global use.
+
+## Verify and publish the scoped provider contract
+
+```task
+id: NK-WP-0038-T02
+status: progress
+priority: high
+```
+
+Run provider regression and new isolation/readback/retry tests, build a pinned
+image, update owner manifests and deploy before the portal uses this endpoint.
+No live user lifecycle mutation is part of deployment verification. OTP provider
+credentials remain a separate NK-WP-0033/KEY-WP-0035 dependency.
+
+Provider regression: 20 tests passed, including tenant-group isolation, repeated
+desired-state updates, failed readback/retry and preservation of global suspension.
+CI now runs the provider suite for changes to identity-provisioner.