Managing End Users

An end user is a person's access record for MCP servers only: they sign in to the account's MCP servers through Celigo OAuth (routed to the company's identity provider where one is set up) and get no workspace access. What each one may call is the union of their grants -- direct, through groups, through roles, and through capability sets. Concerns when managing end users:

• Records -- invite, accept, revoke; identity-provider provisioning (JIT, SCIM); suspending
• Grants -- capability strings per MCP server, on a person, a group, or a role
• Groups and roles -- shared access, and memberships that are manual or synced from the identity provider
• Capability sets -- named bundles of a server's items, granted as one unit
• Effective access -- the compiled result, per person or per server
• End users' own connections -- the credentials each person supplies where a server asks for them

End users are a separate record type from workspace users. The same person can hold both -- the end-user record then shows hasWorkspaceShare: true -- and changing or removing one never touches the other. The account owner is never an end user: the owner reaches every server without a record, is never listed, and can't be invited. Only the owner and administrators manage end users, groups and roles.

How to Run the Steps

This skill names each step by what it reads or changes; the exact calls depend on how you reach the account. Read the one reference that matches your tools -- both follow the step numbers of How to Manage End Users below: