Step 1
Answer access-control questions with the identity and key surfaces
When a buyer asks how access is controlled, answer with the product surfaces that implement it.
- Use `/identity` to show OIDC configuration, provider validation, group-to-role mapping, SCIM token rotation, and identity audit.
- Use `/api-keys` to show that keys are issued, listed, and revoked from the tenant workspace.
- Use the role model to explain which actions require tenant-admin privileges and which are read-only for members or viewers.