tegwick
a0cc947bf6
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
43 lines
1.3 KiB
Markdown
43 lines
1.3 KiB
Markdown
---
|
|
id: NK-WP-0038
|
|
type: workplan
|
|
title: "Tenant-scoped identity lifecycle for account journeys"
|
|
domain: infotech
|
|
repo: net-kingdom
|
|
status: active
|
|
owner: codex
|
|
topic_slug: infotech
|
|
created: "2026-09-13"
|
|
updated: "2026-09-13"
|
|
---
|
|
|
|
## Implement scoped directory access changes
|
|
|
|
```task
|
|
id: NK-WP-0038-T01
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Support USER-WP-0029 T06: /v1/identities/tenant-access changes only the target
|
|
tenant's users/admins groups, never deletes the identity, clears global suspension
|
|
or touches other tenants. Validate tenant/role/status; verify readback before
|
|
reporting success. Repeated desired-state requests converge. Preserve original
|
|
identity-wide owner operations for explicitly global use.
|
|
|
|
## Verify and publish the scoped provider contract
|
|
|
|
```task
|
|
id: NK-WP-0038-T02
|
|
status: progress
|
|
priority: high
|
|
```
|
|
|
|
Run provider regression and new isolation/readback/retry tests, build a pinned
|
|
image, update owner manifests and deploy before the portal uses this endpoint.
|
|
No live user lifecycle mutation is part of deployment verification. OTP provider
|
|
credentials remain a separate NK-WP-0033/KEY-WP-0035 dependency.
|
|
|
|
Provider regression: 20 tests passed, including tenant-group isolation, repeated
|
|
desired-state updates, failed readback/retry and preservation of global suspension.
|
|
CI now runs the provider suite for changes to identity-provisioner.
|