# Operational controls and enterprise identity

> Configure maker-checker approvals, SAML or OIDC SSO, SCIM provisioning, access certifications, and security evidence exports.

The **Operational Controls** workspace separates initiation from approval for high-risk partner activity and
provides Enterprise identity-governance capabilities. These controls apply to human console members;
machine API credentials remain governed by scopes and enterprise security policy.

## Maker-checker approvals

Organization Owners and approval administrators can enable dual control, require one to three independent
approvers, set an expiry window, and allow or prohibit delegation. Policies cover payouts, float limits,
API-key lifecycle changes, webhook destinations, security policy, customer freezes/closures, bulk operations,
corporate-action elections, and proxy votes. A payout threshold can limit approval to material transactions.

The workflow is `PENDING_APPROVAL → APPROVED → PROCESSING → COMPLETED/FAILED`, with explicit `REJECTED`,
`CANCELLED`, and `EXPIRED` terminal states. The initiator cannot approve their own request. Each approval is
bound to the canonical operation-payload fingerprint and, at execution, its idempotency key. Approved
operations send `X-MS-Approval-Id` with the original mutation.

Approval evidence records the actor, member roles, timestamp, reason, payload fingerprint, decision count,
execution binding, and immutable event history. Sensitive payload fields are redacted before storage.

## Enterprise SSO

Enterprise partners may register a Firebase Identity Platform `saml.*` or `oidc.*` provider, verified email
domains, IdP metadata URL, and default just-in-time role. Configuration remains
`PENDING_PLATFORM_ACTIVATION` until MyStocks activates the corresponding provider. Only an `ACTIVE`
configuration can enforce SSO; once enforced, password-authenticated console sessions are rejected.

## SCIM 2.0 provisioning

Create an organization-scoped SCIM bearer token from Operational Controls. The token is shown once and stored
only as a SHA-256 hash. Use base URL `https://mystocks.africa/api/scim/v2` with the standard Users, Groups,
and ServiceProviderConfig resources. Disabling or deleting a user immediately suspends/removes membership and
revokes active sessions. Organization Owner membership cannot be changed through SCIM.

## Access certifications

Start a quarterly review to snapshot every active member, role, and permission. Reviewers may confirm access,
mark a change as required, or revoke access. Revocation suspends the member and terminates active sessions.
The review closes only after every subject has a recorded decision.

## Evidence export

Members with `evidence.export` can download a no-cache JSON evidence bundle containing organization policy,
members, custom roles, session history, approvals, access reviews, SSO/SCIM metadata, and up to 500 recent
audit events. The response includes a SHA-256 `Digest` header for integrity verification. SCIM secrets and raw
credentials are never included.

See [Team access and partner support](/partners/docs/team-access-support) and
[Enterprise security](/partners/docs/enterprise-security).