Operational controls and enterprise identity

The Operational Controls workspace separates initiation from approval for high-risk partner activity and provides Enterprise identity-governance capabilities. These controls apply to human console members; machine API credentials remain governed by scopes and enterprise security policy.

Maker-checker approvals

Organization Owners and approval administrators can enable dual control, require one to three independent approvers, set an expiry window, and allow or prohibit delegation. Policies cover payouts, float limits, API-key lifecycle changes, webhook destinations, security policy, customer freezes/closures, bulk operations, corporate-action elections, and proxy votes. A payout threshold can limit approval to material transactions.

The workflow is PENDING_APPROVAL → APPROVED → PROCESSING → COMPLETED/FAILED, with explicit REJECTED, CANCELLED, and EXPIRED terminal states. The initiator cannot approve their own request. Each approval is bound to the canonical operation-payload fingerprint and, at execution, its idempotency key. Approved operations send X-MS-Approval-Id with the original mutation.

Approval evidence records the actor, member roles, timestamp, reason, payload fingerprint, decision count, execution binding, and immutable event history. Sensitive payload fields are redacted before storage.

Enterprise SSO

Enterprise partners may register a Firebase Identity Platform saml.* or oidc.* provider, verified email domains, IdP metadata URL, and default just-in-time role. Configuration remains PENDING_PLATFORM_ACTIVATION until MyStocks activates the corresponding provider. Only an ACTIVE configuration can enforce SSO; once enforced, password-authenticated console sessions are rejected.

SCIM 2.0 provisioning

Create an organization-scoped SCIM bearer token from Operational Controls. The token is shown once and stored only as a SHA-256 hash. Use base URL https://mystocks.africa/api/scim/v2 with the standard Users, Groups, and ServiceProviderConfig resources. Disabling or deleting a user immediately suspends/removes membership and revokes active sessions. Organization Owner membership cannot be changed through SCIM.

Access certifications

Start a quarterly review to snapshot every active member, role, and permission. Reviewers may confirm access, mark a change as required, or revoke access. Revocation suspends the member and terminates active sessions. The review closes only after every subject has a recorded decision.

Evidence export

Members with evidence.export can download a no-cache JSON evidence bundle containing organization policy, members, custom roles, session history, approvals, access reviews, SSO/SCIM metadata, and up to 500 recent audit events. The response includes a SHA-256 Digest header for integrity verification. SCIM secrets and raw credentials are never included.

See Team access and partner support and Enterprise security.