# SCIM × AI CURRENT_STATUS: UNKNOWN OBSERVATION: SPEC_ONLY FRESHNESS: UNKNOWN PAGE_TYPE: reference CANONICAL_URL: /tools/ea-163-scim-ai CLAIM_IDS: none EVIDENCE_IDS: EVD-EA-163-URL-3B9F9B861CF4, EVD-EA-163-URL-35086ADD5BC5, EVD-EA-163-URL-EFDFF194784D, EA-163-R11-RESEARCH, EA-163-R11-WEB-READBACK UNKNOWN_IDS: EA-163-UNKNOWN-01, EA-163-UNKNOWN-CURRENTNESS OPS_IDS: none ## Summary 「SCIM 2.0（RFC 7643/7644）は、Users／Groups等のidentity resourceをHTTPでプロビジョニング・管理する標準である。AIでは、人員異動をAgentやtool accessへ反映する設計の基盤になり得るが、agent資産・権限・token・memoryの無効化までをSCIMが保証するわけではない。」 ## Current judgment 1. ESTABLISHED [S1+S2 support]: SCIM 2.0 is an HTTP-based application-level protocol and schema/extension suite for provisioning and managing identity data across domains. Core resources include Users and Groups, with custom resources/extensions possible. 2. ESTABLISHED [S1 support]: The core schema is attribute-based and includes mutability, cardinality, returnability, and extensibility. This supports a machine-readable lifecycle contract, not an automatic policy decision about AI capabilities. 3. ESTABLISHED [S2 support]: SCIM does not define a SCIM-specific authentication/authorization scheme. It relies on TLS and standard HTTP auth mechanisms, and the service provider must map the authenticated client to an access-control policy; the authorization model itself is out of scope. 4. INFERENCE [S1+S2]: A company can propose a mapping from SCIM user/group state to agent accounts, tool grants, workspace membership, or service-account disablement, but that mapping is organization-specific and must be labeled PROPOSAL/INFERENCE until an explicit schema/profile and tested implementation exist. ## Scope identity / governance / Enterprise AI Core / interoperability / security / implementation / organization overlay ## Confirmed - ESTABLISHED [S1+S2 support]: SCIM 2.0 is an HTTP-based application-level protocol and schema/extension suite for provisioning and managing identity data across domains. Core resources include Users and Groups, with custom resources/extensions possible. - ESTABLISHED [S1 support]: The core schema is attribute-based and includes mutability, cardinality, returnability, and extensibility. This supports a machine-readable lifecycle contract, not an automatic policy decision about AI capabilities. - ESTABLISHED [S2 support]: SCIM does not define a SCIM-specific authentication/authorization scheme. It relies on TLS and standard HTTP auth mechanisms, and the service provider must map the authenticated client to an access-control policy; the authorization model itself is out of scope. - INFERENCE [S1+S2]: A company can propose a mapping from SCIM user/group state to agent accounts, tool grants, workspace membership, or service-account disablement, but that mapping is organization-specific and must be labeled PROPOSAL/INFERENCE until an explicit schema/profile and tested implementation exist. ## UNKNOWN - EA-163-UNKNOWN-01: standardized SCIM profile for agent resources; current RFC errata/extension landscape; provider custom schemas; revocation SLA; token/session propagation; service-account and tool-secret handling; memory/data deletion; audit completeness; tenant/region/plan gates. - EA-163-UNKNOWN-CURRENTNESS: 外部根拠の再確認日がcanonical body/control-planeで確定していないため、currentnessはUNKNOWNとして保持する。日付を推測補完しない。 ## Evidence - EVD-EA-163-URL-3B9F9B861CF4 (RESEARCH): [S1] SOURCE_CLASS: standards_track_rfc | EXACT_TITLE: System for Cross-domain Identity Management: Core Schema | AUTHOR_ORG: IETF / RFC Editor; Phil Hunt, Kelly Grizzle, Erik Wahls — https://www.rfc-editor.org/rfc/rfc7643.html - EVD-EA-163-URL-35086ADD5BC5 (RESEARCH): [S2] SOURCE_CLASS: standards_track_rfc | EXACT_TITLE: System for Cross-domain Identity Management: Protocol | AUTHOR_ORG: IETF / RFC Editor; Phil Hunt, Kelly Grizzle, Morteza Ansar — https://www.rfc-editor.org/rfc/rfc7644.html - EVD-EA-163-URL-EFDFF194784D (RESEARCH): [S3] SOURCE_CLASS: standards_track_rfc | EXACT_TITLE: System for Cross-domain Identity Management: Definitions, Overview, Concepts, and Requirements | AUTHOR_ORG: IETF / RFC Editor — https://www.rfc-editor.org/rfc/rfc7642.html - EA-163-R11-RESEARCH (RESEARCH): EA-163 監査済みresearch / canonical revision binding - EA-163-R11-WEB-READBACK (IMPL): EA-163 Web body identity / canonical readback ## Failure / limits The RFCs do not define AI agents, model access, prompt ownership, tool permissions, delegated authority, agent memory, or deletion of provider-side data. A SCIM DELETE/PATCH acknowledgement does not prove that cached tokens, sessions, queued jobs, embeddings, tool credentials, or downstream SaaS access were revoked. The RFC explicitly leaves authorization mapping to the service provider and warns about sensitive personal data/privacy. No current provider's SCIM endpoint was tested. ## Failure / limits Do not say SCIM natively manages agents, models, prompts, tools, or authorization. Do not equate a successful SCIM request with immediate downstream access revocation or data deletion. UNIT_CLOSE_STATUS: INDIVIDUAL_BOUNDED_CLOSE / EVIDENCE_RECORDED / UNKNOWN_PRESERVED ## Practice SCIM version and endpoint/resource schema; provider support for Users/Groups/custom extensions; tenant/organization plan; issuer/client authentication; TLS; authorization mapping; PATCH/DELETE semantics; deprovisioning latency; token/session revocation; group-to-role mapping; agent/tool/service-account inventory; downstream provider propagation; data retention and residency; audit API/log availability. ## Practice Evidence-only desk research. No SCIM endpoint was discovered, authenticated, modified, or deleted. ## Practice No SCIM conformance, deprovisioning-latency, revocation-propagation, or agent-asset inventory benchmark was run. ## Practice SCIM resources can contain personally identifying and sensitive data; minimize attributes and protect transport/logs. Audit must join source change, effective identity, target agent/tool asset, policy decision, revocation timestamp, and downstream confirmation. Cost/operability includes connector polling/webhooks, retries, reconciliation, orphan detection, and manual exception handling; not measured. ## Practice Future update Work should pin RFC 7643/7644 and each provider's resource schema, then build a non-destructive TEST_PROFILE for join/move/leave, group change, PATCH/DELETE, stale-token, queued-job, orphan-agent, rollback, audit readback, and downstream revocation. Keep SCIM Core, organization overlay, provider mapping, and proposed agent extension separate. ## WHY_THIS_MATTERS_TO_UPDATE SCIM can provide the identity-lifecycle substrate for removing access when people join, move, or leave. The update must not silently promote SCIM's user/group provisioning model into a standard for agent assets, tool permissions, prompts, or model entitlements. ## SCOPE_ROUTING identity / governance / Enterprise AI Core / interoperability / security / implementation / organization overlay ## CLAIM_OR_RESEARCH_QUESTION What do SCIM 2.0 core schema and protocol actually standardize for cross-domain identity lifecycle, what security boundary do they leave to deployers, and what is only a proposal when mapped to AI agents? ## EVIDENCE_TABLE [S1] SOURCE_CLASS: standards_track_rfc | EXACT_TITLE: System for Cross-domain Identity Management: Core Schema | AUTHOR_ORG: IETF / RFC Editor; Phil Hunt, Kelly Grizzle, Erik Wahlstroem, Chuck Mortimore | CANONICAL_URL: https://www.rfc-editor.org/rfc/rfc7643.html | PUBLICATION_UPDATE_ACCESS: September 2015; accessed 2026-09-14 00:16 JST | VERSION_RELEASE_TAG: RFC 7643 | SUPPORTING_LOCATOR: abstract lines 15-28 for common user schema/extension model; introduction and resource model lines 168-190; schema/attribute model lines 301-314; security/privacy sections listed at lines 114-117 | EVIDENCE_LABEL: VERIFIED_SPEC | RELATION: support for SCIM resource/schema scope; limit for AI-agent extrapolation. [S2] SOURCE_CLASS: standards_track_rfc | EXACT_TITLE: System for Cross-domain Identity Management: Protocol | AUTHOR_ORG: IETF / RFC Editor; Phil Hunt, Kelly Grizzle, Morteza Ansari, Erik Wahlstroem, Chuck Mortimore | CANONICAL_URL: https://www.rfc-editor.org/rfc/rfc7644.html | PUBLICATION_UPDATE_ACCESS: September 2015; accessed 2026-09-14 00:16 JST | VERSION_RELEASE_TAG: RFC 7644 | SUPPORTING_LOCATOR: introduction lines 136-145 for HTTP provisioning/management of Users, Groups, custom resources/extensions; authentication/authorization lines 206-239; client-to-access-control mapping lines 286-305; privacy lines 4213-4216 | EVIDENCE_LABEL: VERIFIED_SPEC | RELATION: support for protocol/lifecycle facts; limit for authorization model. [S3] SOURCE_CLASS: standards_track_rfc | EXACT_TITLE: System for Cross-domain Identity Management: Definitions, Overview, Concepts, and Requirements | AUTHOR_ORG: IETF / RFC Editor | CANONICAL_URL: https://www.rfc-editor.org/rfc/rfc7642.html | PUBLICATION_UPDATE_ACCESS: September 2015; accessed 2026-09-14 00:16 JST | VERSION_RELEASE_TAG: RFC 7642 | SUPPORTING_LOCATOR: SCIM suite overview and terminology; consulted as context for provisioning-domain and cross-domain roles | EVIDENCE_LABEL: VERIFIED_SPEC | RELATION: context; no agent-specific claim closed. ## FINDINGS 1. ESTABLISHED [S1+S2 support]: SCIM 2.0 is an HTTP-based application-level protocol and schema/extension suite for provisioning and managing identity data across domains. Core resources include Users and Groups, with custom resources/extensions possible. 2. ESTABLISHED [S1 support]: The core schema is attribute-based and includes mutability, cardinality, returnability, and extensibility. This supports a machine-readable lifecycle contract, not an automatic policy decision about AI capabilities. 3. ESTABLISHED [S2 support]: SCIM does not define a SCIM-specific authentication/authorization scheme. It relies on TLS and standard HTTP auth mechanisms, and the service provider must map the authenticated client to an access-control policy; the authorization model itself is out of scope. 4. INFERENCE [S1+S2]: A company can propose a mapping from SCIM user/group state to agent accounts, tool grants, workspace membership, or service-account disablement, but that mapping is organization-specific and must be labeled PROPOSAL/INFERENCE until an explicit schema/profile and tested implementation exist. ## LIMITS / COUNTEREVIDENCE / FAILURE ENVELOPE The RFCs do not define AI agents, model access, prompt ownership, tool permissions, delegated authority, agent memory, or deletion of provider-side data. A SCIM DELETE/PATCH acknowledgement does not prove that cached tokens, sessions, queued jobs, embeddings, tool credentials, or downstream SaaS access were revoked. The RFC explicitly leaves authorization mapping to the service provider and warns about sensitive personal data/privacy. No current provider's SCIM endpoint was tested. ## AVAILABILITY_GATES SCIM version and endpoint/resource schema; provider support for Users/Groups/custom extensions; tenant/organization plan; issuer/client authentication; TLS; authorization mapping; PATCH/DELETE semantics; deprovisioning latency; token/session revocation; group-to-role mapping; agent/tool/service-account inventory; downstream provider propagation; data retention and residency; audit API/log availability. ## IMPLEMENTATION_STATE Evidence-only desk research. No SCIM endpoint was discovered, authenticated, modified, or deleted. ## BENCHMARK_OR_EVAL No SCIM conformance, deprovisioning-latency, revocation-propagation, or agent-asset inventory benchmark was run. ## SECURITY / PRIVACY / AUDIT / COST / OPERABILITY SCIM resources can contain personally identifying and sensitive data; minimize attributes and protect transport/logs. Audit must join source change, effective identity, target agent/tool asset, policy decision, revocation timestamp, and downstream confirmation. Cost/operability includes connector polling/webhooks, retries, reconciliation, orphan detection, and manual exception handling; not measured. ## SAFE_WORDING_FOR_FUTURE_BOOK 「SCIM 2.0（RFC 7643/7644）は、Users／Groups等のidentity resourceをHTTPでプロビジョニング・管理する標準である。AIでは、人員異動をAgentやtool accessへ反映する設計の基盤になり得るが、agent資産・権限・token・memoryの無効化までをSCIMが保証するわけではない。」 ## UPDATE_WORK_HANDOFF Future update Work should pin RFC 7643/7644 and each provider's resource schema, then build a non-destructive TEST_PROFILE for join/move/leave, group change, PATCH/DELETE, stale-token, queued-job, orphan-agent, rollback, audit readback, and downstream revocation. Keep SCIM Core, organization overlay, provider mapping, and proposed agent extension separate. ## OPEN_UNKNOWN standardized SCIM profile for agent resources; current RFC errata/extension landscape; provider custom schemas; revocation SLA; token/session propagation; service-account and tool-secret handling; memory/data deletion; audit completeness; tenant/region/plan gates. ## STOP_CONDITION Do not say SCIM natively manages agents, models, prompts, tools, or authorization. Do not equate a successful SCIM request with immediate downstream access revocation or data deletion. UNIT_CLOSE_STATUS: INDIVIDUAL_BOUNDED_CLOSE / EVIDENCE_RECORDED / UNKNOWN_PRESERVED ## EVIDENCE PACKET --- NEXT: /agent/start.json STOP: This is a knowledge projection, not an execution order.