Identity provisioning and sign-in

Use OIDC for authentication and sign-in claims. Use SCIM for user lifecycle, teams, and team membership. Test each integration with a pilot assignment before broad rollout, keep provider identifiers stable, and document whether elevated roles come from OIDC claims or manual administration. Preserve a break-glass account outside the automated scope.