Resolve Joule access

Diagnose the failure before proposing a change. Treat login, authorization, and IAS App2App setup as separate problems.

Guardrails

• Never drive an interactive Joule or BTP SSO/passcode flow for the user.
• Never log the user out or retry login in a loop.
• Never print, persist, or request client secrets or binding JSON.
• Use read-only checks first. Do not mutate roles directly with the BTP CLI.
• Repair managed access through Terraform. Show the plan and obtain approval before applying it to a live subaccount.
• Stop if a plan contains unrelated changes, replacements, deletions, or paid service changes.

Diagnose once