---
id: NK-WP-0038
type: workplan
title: "Tenant-scoped identity lifecycle for account journeys"
domain: infotech
repo: net-kingdom
status: active
owner: codex
topic_slug: infotech
created: "2026-09-13"
updated: "2026-09-13"
---

## Implement scoped directory access changes

```task
id: NK-WP-0038-T01
status: done
priority: high
```

Support USER-WP-0029 T06: /v1/identities/tenant-access changes only the target
tenant's users/admins groups, never deletes the identity, clears global suspension
or touches other tenants. Validate tenant/role/status; verify readback before
reporting success. Repeated desired-state requests converge. Preserve original
identity-wide owner operations for explicitly global use.

## Verify and publish the scoped provider contract

```task
id: NK-WP-0038-T02
status: progress
priority: high
```

Run provider regression and new isolation/readback/retry tests, build a pinned
image, update owner manifests and deploy before the portal uses this endpoint.
No live user lifecycle mutation is part of deployment verification. OTP provider
credentials remain a separate NK-WP-0033/KEY-WP-0035 dependency.

Provider regression: 20 tests passed, including tenant-group isolation, repeated
desired-state updates, failed readback/retry and preservation of global suspension.
CI now runs the provider suite for changes to identity-provisioner.