Administrator runbooks

Invite a user

1. Open Users & Groups.
2. Invite the person's company-managed address.
3. Assign the minimum required role.
4. Add the user to existing job-function groups.
5. Review effective access before asking them to connect an AI client.

Change group access

1. Open the group and identify the business workflow.
2. Prefer individual tool grants when the full app is unnecessary.
3. Add explicit restrictions for tools the group must not use.
4. Review a representative member's effective access.
5. Verify a bounded read in Audit.

Rotate a shared credential

1. Create the replacement in the provider.
2. Preserve the same tenant and least-privilege scope.
3. Update the app in Stackyapper.
4. Verify a read and check Audit.
5. Revoke the old provider credential.

Offboard a user

1. Remove or suspend the company identity using the authoritative identity system.
2. Remove direct Stackyapper membership if it is not provisioned.
3. Revoke the user's AI and API clients.
4. Revoke personal app authorizations.
5. Review recent Audit activity and preserve required records.

Respond to a denied or failed call