Govern Enterprise Access

Identity-provider assertions are inputs. Tenant and permission semantics stay in the product. Join is not permission. Break-glass is a logged, time-bounded grant with a removal predicate, not a standing admin role.

Open access authority lifecycle and privileged evidence when the grant ledger or review evidence needs depth.