Identity Provider

13 entities and 67 agent-callable operations in identity_provider. Each operation is addressed as {mega_tool}/identity_provider/{entity}/{operation} and carries the same permission check over MCP and REST.

`access_campaign`

Operation	Mega-tool	What it does
`cancel`	`entity_crud`	draft \| active -> cancelled.
`close`	`entity_crud`	active -> closed.
`create`	`entity_crud`	Create a DRAFT access-certification campaign.
`launch`	`entity_crud`	draft -> active.
`list`	`entity_crud`	List access-certification campaigns in this organization's subtree with their state and decided/total counts — the 'are our access reviews on track?' view.
`read`	`entity_crud`	Read one campaign in full: scope (which organizations, which kinds of grant, which users), reviewer configuration, schedule, and any GRC finding it is linked…
`refresh_items`	`entity_crud`	Re-run the population build on an ACTIVE campaign to pick up grants created after launch.
`update`	`entity_crud`	Edit a campaign.

`access_item`

Operation	Mega-tool	What it does
`certify`	`entity_crud`	Certify that the subject keeps this access.
`list`	`entity_crud`	List certifiable access items — the reviewer's work queue.
`read`	`entity_crud`	Read one certifiable item with the full snapshot the reviewer decides on: the codenames this grant actually confers, its provenance and which IdP group drove…
`revoke`	`entity_crud`	Revoke this access.

`app_assignment`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Grant or deny a subject access to a relying party.
`delete`	`entity_crud`	Revoke an assignment.
`explain`	`entity_crud`	Why can (or can't) this user reach this application?
`list`	`entity_crud`	List application assignments in this organization's subtree.
`list_for_app`	`entity_crud`	Who can reach this app?
`list_for_user`	`entity_crud`	What can this user reach?
`read`	`entity_crud`	Read one application assignment, with its carve-outs, claim narrowing and ACR requirements.
`update`	`entity_crud`	Edit an assignment's expiry, carve-outs, claim narrowing or ACR.

`campaign_progress`

Operation	Mega-tool	What it does
`read`	`report_query`	Progress of an access-certification campaign: decided vs total, and the tallies by decision, item kind, provenance and revocation state.

`claim_release_policy`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Create a claim release policy.
`delete`	`entity_crud`	Soft-delete a claim release policy.
`list`	`entity_crud`	List claim release policies for the organization.
`preview_claims`	`entity_crud`	Preview exactly which claims a relying party would receive for one user at one scope — and, for every claim it would NOT receive, the reason.
`read`	`entity_crud`	Read one claim release policy, including its full mapping.
`update`	`entity_crud`	Update a claim release policy.

`device_binding`

Operation	Mega-tool	What it does
`delete`	`entity_crud`	Revoke a device binding — the correct action for a lost or stolen laptop.
`list`	`entity_crud`	List sign-in device bindings in this organization's subtree — which browsers each user has signed in from, and which of them are correlated to a managed MDM…
`read`	`entity_crud`	Read one device binding with the correlated MDM device's posture inline — enrollment status, compliance status and when it was last actually evaluated.
`update`	`entity_crud`	Correlate a sign-in device binding to a managed MDM device, and/or mark it explicitly trusted.

`idp_session`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List IdP sessions in this organization's subtree — who is signed in, from where, at what assurance, and until when.
`list_active`	`entity_crud`	Live sessions only — is_active AND not past their absolute or idle expiry.
`read`	`entity_crud`	Read one IdP session with every relying party it was asserted to and that RP's logout state.
`terminate`	`entity_crud`	End ONE IdP session and notify every relying party it reached (back-channel logout).
`terminate_all_for_user`	`entity_crud`	End EVERY live IdP session for one user and fan out to every relying party each one reached.

`issuance_event`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List credential-issuance decisions (successful and denied) for the caller's organization subtree, newest first.
`list_for_relying_party`	`entity_crud`	Issuance history for ONE relying party — 'what has this application been issued, and what was it refused?'.
`read`	`entity_crud`	Read one issuance event in full, including the claim NAMES released, the authentication context (acr/amr), the session it belonged to and the derived token…

`relying_party`

Operation	Mega-tool	What it does
`activate`	`entity_crud`	Activate a relying party so it may obtain tokens.
`create`	`entity_crud`	Register a new relying party.
`deactivate`	`entity_crud`	The kill switch: stop new token issuance for this relying party immediately.
`delete`	`entity_crud`	Soft-delete a relying party, cascading to its assignments and claim-release policies.
`import_sp_metadata`	`entity_crud`	Import a SAML SP metadata document into a relying party (protocol="saml").
`list`	`entity_crud`	List relying parties (downstream OIDC / OAuth 2.1 / SAML applications) registered in the calling organization.
`read`	`entity_crud`	Read one relying party in full.
`rotate_secret`	`entity_crud`	Rotate the relying party client secret.
`update`	`entity_crud`	Update a relying party.

`signing_key`

Operation	Mega-tool	What it does
`delete`	`entity_crud`	PERMANENTLY REFUSED.
`generate`	`entity_crud`	Generate a new signing key in 'pending'.
`jwks_preview`	`entity_crud`	Preview the published JWKS exactly as a relying party would fetch it.
`list`	`entity_crud`	List signing keys in the ring.
`promote`	`entity_crud`	Make a published key the active signer, demoting the incumbent atomically.
`publish`	`entity_crud`	Publish a pending key into the JWKS.
`read`	`entity_crud`	Read one signing key by kid.
`retire`	`entity_crud`	Retire a key: drop it from JWKS and DESTROY its private material.

`sod_pair`

Operation	Mega-tool	What it does
`create`	`entity_crud`	Declare a toxic permission combination for this organization and every descendant.
`delete`	`entity_crud`	Retire a segregation-of-duties rule.
`list`	`entity_crud`	List the declared segregation-of-duties rules governing this organization's subtree — which permission combinations are toxic, how severe each is, and whether…
`preview_impact`	`entity_crud`	How many subjects WOULD this rule flag, without declaring it?
`read`	`entity_crud`	Read one segregation-of-duties rule in full, including the justification — the field that makes a finding triageable.
`update`	`entity_crud`	Edit a segregation-of-duties rule — including arming it by moving enforcement from 'warn' to 'block'.

`sod_posture`

Operation	Mega-tool	What it does
`read`	`report_query`	Segregation-of-duties posture for this organization's subtree: open, waived and resolved finding counts, a breakdown by severity and by detection source…

`sod_violation`

Operation	Mega-tool	What it does
`list`	`entity_crud`	List detected segregation-of-duties findings in this organization's subtree — who holds both halves of a declared toxic pair, since when, and whether the risk…
`read`	`entity_crud`	Read one SoD finding with its full evidence — WHICH roles confer each half of the toxic pair, which grants are denied by an override, and which organizations…
`reopen`	`entity_crud`	Withdraw a waiver and return the finding to open, before its expiry.
`waive`	`entity_crud`	Accept the risk on an open finding, with a reason and — strongly recommended — an expiry, after which the nightly sweep returns it to open.

Parameter schemas and permission codenames are in the full reference — sign in — or call prism_introspect(dimension="capability_search", query="…") with your key.

In the full reference this application appears under entity_crud, report_query.