Identity Access

11 entities and 46 agent-callable operations in identity_access. Each operation is addressed as {mega_tool}/identity_access/{entity}/{operation} and carries the same permission check over MCP and REST.

`conditional_access`

Operation	Mega-tool	What it does
`producers`	`report_query`	Which conditional-access predicates have a live signal producer, per evaluation lane (login / mcp_dispatch / issuance).

`conditional_access_policy`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Create a conditional-access policy.
`delete`	`entity_crud`	Soft-delete a conditional-access policy.
`list`	`entity_crud`	List conditional-access policies in EVALUATION order (priority ascending, then id — the order the evaluator reads them and therefore the order they fire in).
`read`	`entity_crud`	Read one conditional-access policy, including its RP scope.
`search`	`entity_crud`	Search conditional-access policies by name or description, returned in evaluation order.
`simulate`	`entity_crud`	Dry-run the conditional-access evaluator over a hypothetical request and return the Decision it would reach.
`update`	`entity_crud`	Update a conditional-access policy.

`employee_binding`

Operation	Mega-tool	What it does
`bind`	`entity_crud`	Bind an employee record to a specific user account (source='manual').
`list`	`entity_crud`	List the employee->user binding triage queue for this organization subtree.
`no_account_expected`	`entity_crud`	Record the terminal operator decision that this employee legitimately has no user account (a deckhand, a contractor, a seasonal hire).
`read`	`entity_crud`	Read one employee's binding state together with its LIVE resolution: the reason verbatim (bound_fk / email_match / no_email / no_match / ambiguous) and every…
`reopen`	`entity_crud`	Undo a 'no_account_expected' dismissal, returning the employee to the triage queue.
`unbind`	`entity_crud`	Clear an employee's binding, returning the row to the triage queue.

`id_p_group_grant`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List id_p_group_grants with filtering and pagination
`read`	`entity_crud`	Get detailed id p group grant information
`search`	`entity_crud`	Search id_p_group_grants with fuzzy matching

`idp_group_membership`

Operation	Mega-tool	What it does
`distinct_groups`	`entity_crud`	Distinct observed (group_key, idp_source, idp_provider_ref) triples with a user count — the set of groups an authorization rule can be written against.
`list`	`entity_crud`	List observed IdP group memberships (per-user rows), org-scoped.
`read`	`entity_crud`	Get one observed IdP group membership row.

`provisioned_grant`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List provisioned_grants with filtering and pagination
`read`	`entity_crud`	Get detailed provisioned grant information
`search`	`entity_crud`	Search provisioned_grants with fuzzy matching

`provisioning`

Operation	Mega-tool	What it does
`binding_summary`	`report_query`	Employee->user binding coverage for this organization subtree: counts by binding status (bound / unbound / ambiguous / no_account_expected) and the two triage…
`delivery_summary`	`report_query`	SCIM outbound delivery health per target over a time window: how many pushes succeeded, how many are still retrying, how many dead-lettered, and how many were…
`failure_detail`	`report_query`	The failed and dead-lettered SCIM pushes themselves, newest first: which target, which user, how many attempts, and the error text verbatim.

`provisioning_principal`

Operation	Mega-tool	What it does
`bind`	`entity_crud`	Bind a bounded service principal to one provisioning lane, with an explicit declared ceiling.
`create`	`entity_crud`	Bind a bounded service principal to one provisioning lane with an explicit declared ceiling (this is `bind_provisioning_principal` under the standard verb…
`delete`	`entity_crud`	Deactivate a binding — clears the principal and sets is_active=false, returning the lane to the deploy-safe default in which every permission-bearing role…
`list`	`entity_crud`	List the bounded provisioning principals for this organization, with each binding's EFFECTIVE ceiling (declared permissions intersected with what the…
`preview`	`entity_crud`	SP-5 step 2 — enumerate exactly what binding a principal WOULD apply, without applying anything.
`read`	`entity_crud`	Read one provisioning-principal binding by id, with its EFFECTIVE ceiling (declared codenames intersected with what the principal actually holds) and the…
`unbind`	`entity_crud`	Unbind a provisioning lane, returning it to the deploy-safe default in which every permission-bearing role grant is refused.
`update`	`entity_crud`	Edit a binding: toggle is_active, revise notes, or change the declared ceiling.

`provisioning_skip`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List the role grants an automated provisioning lane REFUSED under the monotonicity gate (`skipped_monotonicity`), each with the reason it was refused.
`summary`	`entity_crud`	Aggregate `skipped_monotonicity` for this organization: the total, and the breakdown by reason, by IdP source, by IdP group and by grant.

`scim_outbound_resource_map`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List the downstream resource mappings (our user id -> the downstream's SCIM resource id) for this organization subtree.
`read`	`entity_crud`	Read one downstream resource mapping: the remote id, when it was last pushed, and the outcome of that push.

`scim_outbound_target`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Register a downstream SCIM 2.0 provisioning target.
`delete`	`entity_crud`	Soft-delete a SCIM outbound target.
`list`	`entity_crud`	List the downstream SCIM 2.0 provisioning targets configured across this organization subtree.
`read`	`entity_crud`	Read one SCIM outbound target's full configuration and health (last success, last error).
`replay_dead_letter`	`workflow_action`	Re-drive one dead-lettered SCIM push as a NEW firing stamped replay=true.
`resync_user`	`workflow_action`	Push ONE user's current state to the downstream now, outside the event lane.
`test_connection`	`workflow_action`	Dial the downstream now and report what came back: GET {base_url}/ServiceProviderConfig with the stored credential.
`update`	`entity_crud`	Update a SCIM outbound target, including arming it (is_active) and its per-lane push switches.

Parameter schemas and permission codenames are in the full reference — sign in — or call prism_introspect(dimension="capability_search", query="…") with your key.

In the full reference this application appears under entity_crud, report_query, workflow_action.